Could you please help me design a solution for the below use case .
Usecase:I have one CSV file which contains Service center locations and has fields Name,Address,Status,Rating.
Now I want , if user updates any field in this file it should reflect in KV store lookup file .
What I tried:
I have created KV store lookup for KV store CRUD .In dashboard, I have created one form which contains all these input fields, where user can perform CRUD operations for KV store lookup file. Everything is working properly but I am not able to update the CSV file. Is there anyway to update CSV file also when we update KV store lookup?
Please help me to find the solution of this usecase.
Did you find a solution? We also update some lookup files periodically almost the same way and the file itself (/appl/splunk/etc/apps/APPNAME/lookups) will not update.
The KV store is up to date, but the file not...
If i delete the file in the APP before the update, then the file is new created. Did you insert in your script that you delete the file in the folder bevor update or is there an other solution?
Assuming both of these are lookup files, you can copy the entire contents of one to another with something as simple as:
|inputlookup csvLookupDefinition|outputlookup kvLookupDefinition
You could of course reverse the process (which i think is your last question) but you should be careful about about situations where there are deltas in both.
I'm not totally clear from your question if this is likely, but if so, you will want to expand the process to load both sets of data, perform any deduplication and establish which of the files contents takes precedence before writing your output.
Thanks @nickhillscpl for your reply,Here CSV file is not a lookup file. The CSV file is stored at C:\Program Files\Splunk\etc\apps\myApp\bin and I want to know ,if I update this file(CSV) the same needs to be reflected in KV store lookup also or If I update KV store lookup the same thing also updated in CSV file.
Must it be in that path?
If you moved the file to $SPLUNK_HOME/etc/apps/yourapp/lookups you could make it a lookup file and do as I mentioned above (both read & write to/from it)
If you have to leave it in another path, you could configure a file monitor on that path and index it.
That way changes to it would get ingested, and you could table the results and write it to the KV Store, but you would not be able to write changes back into it.
Must it be in that path?
ans:Yes,I have a python file which also reading this CSV file. So its very difficult to me to change the location of CSV File.
Please check this link(https://www.hurricanelabs.com/splunk-tutorials/building-a-crud-dashboard-utilizing-a-kv-store-in-spl...) as a reference for KV store lookup CRUD oprations.