All Apps and Add-ons

importing data to existing splunk kv store using lookup editor causing issues

sanjeev543
Communicator

I am trying to bulk edit the KV store lookup by exporting as CSV using lookup editor, once I make changes to the data fields (not modifying _key) and importing the same file using lookup editor causing data to be appended to the existing KV Store and it generating new _key values for the data.
Is there a way to restrict this behavior of lookup editor? @LukeMurphey

0 Karma
1 Solution

LukeMurphey
Champion

There isn't yet. I opened a ticket to add the capability to prevent duplication when the _key already exists. See https://lukemurphey.net/issues/2594

View solution in original post

0 Karma

LukeMurphey
Champion

There isn't yet. I opened a ticket to add the capability to prevent duplication when the _key already exists. See https://lukemurphey.net/issues/2594

0 Karma
Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...