Step 2: Set up the configuration files for the KV Store

In this step, we'll set up these Splunk configuration files for KV Store:

  • A collections.conf file to create the KV Store collection.
  • A transforms.conf file to define a lookup, which we'll use in a search to get data from our KV Store collection.

You'll need to save these configuration files to your app directory, which is $SPLUNK_HOME/etc/apps/kvstoretutorial, so make sure you have access to source files on your Splunk instance. You might need to contact your Splunk administrator for permission and access.

Create a KV Store collection called "mycollection":

  1. Using a text editor, create a file called collections.conf under $SPLUNK_HOME/etc/apps/kvstoretutorial/default.
  2. Copy and paste the following into the file:
  3. #
    # Splunk app KV Store collection file
    #
    
    [mycollection]
    

    A stanza with the name of your KV Store collection is all that is required. You can specify additional settings if you want to enforce data types or create accelerations. For more, see Use configuration files to create a KV Store collection store.

  4. Save the file.

Create a lookup for the KV Store collection called "kvstore_lookup":

  1. Using a text editor, create a file called transforms.conf under $SPLUNK_HOME/etc/apps/kvstoretutorial/default.
  2. Copy and paste the following into the file:
  3. #
    # Splunk app KV Store transforms file
    #
    
    [kvstore_lookup]
    external_type = kvstore
    collection = mycollection
    fields_list = _key, CustID, CustName, CustStreet, CustState, CustCity, CustZip
    

    The lookup stanza for a KV Store collection needs to have the correct type ("kvstore"), the name of the KV Store collection ("mycollection"), and the fields that you want to be able to access (the fields above will be used in the customer info form, and we want to see the auto-generated key ID field, "_key"). For more about KV Store lookups, see Use lookups with KV Store data.

  4. Save the file.
  5. Restart Splunk.

Continue to Step 3: Add a record containing the form data to the KV Store collection.