When you are loading the data into the KVStore, you want to rename the field you're using as _key, therefore it will be used as the primary key record instead of what Splunk autogenerated for you.
I'm using a Python script to generate the documents I put into KVStore as part of another process, but an example of how I build the document is:
doc = dict(_key=str(item['IP']), User=str(item['User']), Domain=str(item['Domain']),
Last_Update=int(float(item['Last_Update'])), Last_PA_Send=int(0))
consider the item[xxxx] as my fields from my search results, since I wanted my IP field to be the primary key I renamed it to _key prior to sending it to KVStore.
... View more