Storing the values of "search" directly in the KV store collection instead of a CSV file.

Applicability

Description

The user wants to store the values of the "search" directly in the KV store collection rather than a CSV file. 

Since the user aims to skip saving "search results" to a CSV file and directly store the data in a KV store collection. This method avoids the intermediate file creation step and seamlessly integrates the data into a structured storage system, facilitating easier retrieval and manipulation.

Investigation

By creating a new app and providing it with a unique name and label (bch7-em_kvstore_app) that has

- app.conf
- collections.conf
- transforms.conf

Inside the app.conf configuration can look like -

[launcher]
author = sparui@splunk.com
description = App for KVStore lookup testing
version = 1.0.1[package]
id = bch7-em_kvstore_app
check_for_updates = false[install]
state = enabled
build = 1.1
allows_disable = true[ui]
is_visible = true
label = App for KVStore lookup testing

Inside the collection.conf configuration can look like -

### KV-Store collection file, collections.conf ###[csvcoll]

Inside the transform.conf configuration can look like -

[csv_lookup]
external_type = kvstore
collection = csvcoll
fields_list = _time, count, event_message, host

In the transforms.conf, add all the SCV files that need to be managed under the KV store collection "[csvcoll]"

Resolution

Once all components are packaged and installed on the machine, they can be seamlessly executed for searching and directly interacting with the KV Store Collection : 

earliest=-24h index=_internal host=sh* log_level=WARN OR log_level=ERROR | dedup event_message | table _time, count, event_message, host | outputlookup csv_lookup