@sjodle, this can be done using batch_save endpoint http://docs.splunk.com/Documentation/Splunk/6.3.2/RESTREF/RESTkvstore#storage.2Fcollections.2Fdata.2F.7Bcollection.7D.2Fbatch_save You can find few examples on this page as well http://dev.splunk.com/view/webframework-developapps/SP-CAAAEZG As suggested by @Murali2888 - batch_save is very similar to SPL command outputlookup append=true , it inserts all new documents and replaces all documents which already exist in collection. ... View more

Ok, KVStore lookups available only starting from version 6.2 ... View more

Two options: a) you can use batch_save REST call http://docs.splunk.com/Documentation/Splunk/6.2.3/RESTREF/RESTkvstore#storage.2Fcollections.2Fdata.2F.7Bcollection.7D.2Fbatch_save It is limited by default to maximum of 1000 documents, so in your case it will take 3,000 calls. b) you can create a lookup for this collection, save your data into CSV file and migrate it from CSV into your kvstore collection by issuing a search like "| inputlookup myfile.csv | outputlookup mykvstorecollection_lookup" 2 & 3. That is not supported. Even if you will find out how to make 2 and 3 work - there are will be a huge chance that not everything will work as you expect or something can be broken with following updates. Please let us know if you have some other reasons (other than #1) why would you like to have #2 and #3. ... View more

If you want to take advantage of KVStore in Search Head Pooling environment you need a) Make all nodes of Search Head Pool to be visible to each other on the network. b) On each member of Search Head Pool specify the key you discovered (kvstore/replication_host) to the hostname, which can be used on other member to discover this member on network. c) Verify that kvstore/port is open and other member can get access to this port. d) Just start all members on by one. KVStore automatically will be configured with Cluster. e) You can use this REST endpoint to verify that KVStore is in Cluster now http://docs.splunk.com/Documentation/Splunk/6.2.2/RESTREF/RESTintrospect#server.2Fintrospection.2Fkvstore.2Freplicasetstats or just query introspection index as it will be populated with introspection data including information from this url. Or use Distributed Management Console to check your configuration. ... View more