This blog-screencast series will cover how to CRUD (create / read / update / delete) a KV Store collection in Splunk.
KV Stores are Mongo databases in Splunk. Learning how to CRUD data in a KV Store will help you to better understand how KV Store collections work. Following along in this tutorial will take you from KV Store novice to expert. We will also build a custom Splunk dashboard that will help to reinforce the concepts around CRUDing KV Store data. Our dashboard will be a sample project list that will provide information such as the project name, due date, and status (e.g. completed or on-hold).
Hopefully you’ll follow along and by the end you’ll be an unstoppable KV Store master.
Note: As with my other blog-screencast tutorials, feel free to follow along with the videos as well as the details included in the associated blog posts.
In the blog series ‘The Basics of Creating and CRUDing a KV Store in Splunk’, we covered how we can create and KV stores through config files, as well as through the Splunk UI (user interface). We also covered how to apply CRUD (Create / Read / Update / Delete) to our KV Store using the Splunk Query Language. If you’re starting from scratch, I recommend you start there — especially if you’re new to KV Stores.
In this new series, we’ll take those ideas we learned and apply them to a dashboard where users can easily create, update, and delete data, from a KV store through a custom web form.
Reading the Dashboard
Let’s use this as the base of the search in our dashboard (the Read portion):
Run the search in the search window. Then click on ‘Save As’ < ‘Dashboard Panel’. Then fill out all the appropriate information, click ‘Save’, and then ‘View Dashboard’.