All Apps and Add-ons

importing data to existing splunk kv store using lookup editor causing issues

sanjeev543
Communicator

I am trying to bulk edit the KV store lookup by exporting as CSV using lookup editor, once I make changes to the data fields (not modifying _key) and importing the same file using lookup editor causing data to be appended to the existing KV Store and it generating new _key values for the data.
Is there a way to restrict this behavior of lookup editor? @LukeMurphey

0 Karma
1 Solution

LukeMurphey
Champion

There isn't yet. I opened a ticket to add the capability to prevent duplication when the _key already exists. See https://lukemurphey.net/issues/2594

View solution in original post

0 Karma

LukeMurphey
Champion

There isn't yet. I opened a ticket to add the capability to prevent duplication when the _key already exists. See https://lukemurphey.net/issues/2594

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...