Building for the Splunk Platform

How to create a KVStore using Python SDK w/ SPL commands?

yurippe
Explorer

Hello,
I am trying to create a kvstore that I can use in a | inputlookup and / or | lookup SPL command. I can create a KVStore using the python SDK, but it can not be used with the above commands.
(I have tried many things and variations in the create command, but this is what I assume to be the most correct:)

>>> splunk.kvstore.create(name="testkvstore", **{"sharing": "global"})
{'status': 201, ...}
>>> splunk.kvstore["testkvstore"].data.app
'system'
>>> splunk.kvstore["testkvstore"].data.sharing
'system'
>>> splunk.kvstore["testkvstore"].data.owner
'nobody'

>>> splunk.kvstore["testkvstore"].data.insert(json.dumps({"_key": "test", "value": "result"}))
{'_key': 'test'}

Yet I cannot find it with inputlookup nor lookup. This does not work in splunk cloud nor local instance

Labels (3)
0 Karma
1 Solution

starcher
SplunkTrust
SplunkTrust

Did you create a transforms stanza to reference the kvstore collection?

View solution in original post

starcher
SplunkTrust
SplunkTrust

Did you create a transforms stanza to reference the kvstore collection?

yurippe
Explorer

No, any tips on how I would do this via the RESP API ?

0 Karma

yurippe
Explorer

I figured it out, thank you very much
Here is enough code to be able to figure it out for anyone else who might stumble upon this:

kv = splunk.kvstore
kv.create(name="kvtestcollection", fields={"_key": "string", "name": "string"}, owner="nobody", sharing="system")
kv["kvtestcollection"].data.insert(json.dumps({"_key": "hello", "name": "world"}))
#kv["kvtestcollection"].delete()
transforms = splunk.confs["transforms"]
transforms.create(name="kvtestcollection_lookup", **{"external_type": "kvstore", "collection": "kvtestcollection", "fields_list": "_key, name", "owner": "nobody"})
#transforms["kvtestcollection_lookup"].delete()
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...