![]() When you create a KV Store lookup, the collection should have at least two fields. See Use configuration files to create a KV Store collection on the Splunk Developer Portal. If you have access to the configuration files for your Splunk deployment, you can create a KV Store collection yourself. To download the Splunk App for Lookup File Editing, see Splunk App for Lookup File Editing on Splunkbase. If you use Splunk Cloud Platform, you need to use the Splunk App for Lookup File Editing to add a unique KV Store collection to your Splunk deployment. Splunk Web currently does not support the creation of KV Store collections. Certain apps, such as Enterprise Security, include KV Store collections with their installation. Requires a full rewrite of the file for edit operations (outputlookup).īefore you create a KV Store lookup, your Splunk deployment must have at least one KV Store collection.Does not provide multiuser access locking.Integrating with other applications such as Microsoft Excel is easier because CSV is a standard format.CSV files are easier to modify manually.Performs well for files that are small or rarely modified.Provides REST API access to the data collection.ĭoes not support case-insensitive field lookups.Allows you to define field accelerations to improve search performance. ![]() Allows optional data type enforcement on write operations.Consider the following tradeoffs when deciding whether a KV Store lookup or a CSV-based lookup is best for your scenario: Before the KV Store feature was added, you might have used CSV-based lookups to augment data within your apps. The KV Store adds a lookup type to use with your apps. Use a KV Store lookup when you have a large lookup table or a table that is updated often Invoke KV Store lookups through REST endpoints or by using the search commands lookup, inputlookup, and outputlookup. KV Store lookups populate your events with fields pulled from your App Key Value Store (KV Store) collections.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |