$npx -y skills add grandcamel/Splunk-Assistant-Skills --skill splunk-kvstoreInteraction with App Key Value Store for persistent metadata.
| 1 | # splunk-kvstore |
| 2 | |
| 3 | Interaction with App Key Value Store for persistent metadata. |
| 4 | |
| 5 | ## Purpose |
| 6 | |
| 7 | Create and manage KV store collections and records for persistent data storage. |
| 8 | |
| 9 | ## Risk Levels |
| 10 | |
| 11 | | Operation | Risk | Notes | |
| 12 | |-----------|------|-------| |
| 13 | | List collections | - | Read-only | |
| 14 | | Get record | - | Read-only | |
| 15 | | Query collection | - | Read-only | |
| 16 | | Insert record | ⚠️ | Easily reversible | |
| 17 | | Create collection | ⚠️ | Easily reversible | |
| 18 | | Update record | ⚠️ | Previous value lost | |
| 19 | | Delete record | ⚠️⚠️ | Data loss, may be in backups | |
| 20 | | Delete collection | ⚠️⚠️⚠️ | **IRREVERSIBLE** - all data lost | |
| 21 | |
| 22 | ## Triggers |
| 23 | |
| 24 | - "kvstore", "collection", "key-value" |
| 25 | - "persist", "store" |
| 26 | |
| 27 | ## CLI Commands |
| 28 | |
| 29 | | Command | Description | |
| 30 | |---------|-------------| |
| 31 | | `kvstore list` | List collections in app | |
| 32 | | `kvstore create <name>` | Create KV store collection | |
| 33 | | `kvstore delete <name>` | Delete collection (**IRREVERSIBLE**) | |
| 34 | | `kvstore truncate <collection>` | Delete all records in collection | |
| 35 | | `kvstore insert <collection>` | Insert record into collection | |
| 36 | | `kvstore batch-insert <collection>` | Insert multiple records at once | |
| 37 | | `kvstore get <collection> <key>` | Get record by _key | |
| 38 | | `kvstore update <collection> <key>` | Update existing record | |
| 39 | | `kvstore delete-record <collection> <key>` | Delete individual record by _key | |
| 40 | | `kvstore query <collection>` | Query with filters | |
| 41 | |
| 42 | ## Examples |
| 43 | |
| 44 | ```bash |
| 45 | # Show help |
| 46 | splunk-as kvstore --help |
| 47 | |
| 48 | # List collections |
| 49 | splunk-as kvstore list --app search |
| 50 | |
| 51 | # Create collection |
| 52 | splunk-as kvstore create my_collection --app search |
| 53 | |
| 54 | # Insert record |
| 55 | splunk-as kvstore insert my_collection '{"name": "test", "value": 123}' --app search |
| 56 | |
| 57 | # Get record by _key |
| 58 | splunk-as kvstore get my_collection abc123 --app search |
| 59 | |
| 60 | # Query collection with filters |
| 61 | splunk-as kvstore query my_collection --query '{"name": "test"}' --app search |
| 62 | |
| 63 | # Update record by _key |
| 64 | splunk-as kvstore update my_collection abc123 '{"name": "updated"}' --app search |
| 65 | |
| 66 | # Delete individual record by _key (use delete-record, not delete) |
| 67 | splunk-as kvstore delete-record my_collection abc123 --app search |
| 68 | |
| 69 | # Truncate collection (delete all records, keep collection) |
| 70 | splunk-as kvstore truncate my_collection --app search |
| 71 | |
| 72 | # Batch insert multiple records from JSON file |
| 73 | splunk-as kvstore batch-insert my_collection records.json --app search |
| 74 | |
| 75 | # Delete collection (IRREVERSIBLE - removes collection and all records) |
| 76 | splunk-as kvstore delete my_collection --app search --force |
| 77 | ``` |
| 78 | |
| 79 | ## Command Terminology |
| 80 | |
| 81 | | Command | Target | Description | |
| 82 | |---------|--------|-------------| |
| 83 | | `delete-record` | Single record | Deletes one record by its `_key` | |
| 84 | | `delete` | Collection | Deletes entire collection and all records (**IRREVERSIBLE**) | |
| 85 | |
| 86 | ## API Endpoints |
| 87 | |
| 88 | - `GET/POST/DELETE /services/storage/collections/config` - Collections |
| 89 | - `GET/POST /services/storage/collections/data/{collection}` - Records |
| 90 | - `GET/PUT/DELETE /services/storage/collections/data/{collection}/{key}` - Record |
| 91 | |
| 92 | ## SPL Patterns |
| 93 | |
| 94 | ```spl |
| 95 | | inputlookup collection_name |
| 96 | | outputlookup collection_name append=true |
| 97 | ``` |