I have the same issue. I'm on the Victoria distro of Splunk cloud.  I opened a ticket with Splunk support and they say that the KV Store/Service is already enabled and running on our stack and to go to proofpoint to fix.  I can't install an older version of the app to see if it works because I'm on cloud.  Proofpoint initially tried to kick it back to splunk saying it's a splunk issue, so I don't know what else to do.  I tried uninstalling and reinstalling the app, restarting the cloud stack, etc, so I'm basically stuck.  ... View more

Thanks for the feedback!  The server guys change it semi regularly (whenever they add/remove/change a server).  So I think you're right about ingesting it, then having it in the KV store would probably be the best method.  On that same vein....  The actual Server DB is an Access DB, they currently export it to CSV as i haven't figured out a better method to ingest it into Splunk.  DB connect isn't an option for us.  You wouldn't happen to have a better method other than CSV and ingest would you? ... View more