Data can be added to a KV store collection in which of the following format(s)?

The Splunk KV (Key-Value) Store is a lookup feature that stores data as collections of records. Each record within a collection is fundamentally a JSON document. When adding data to a KV Store collection, whether through the REST API or using SPL commands like outputlookup, the data must be structured in JSON format. While source data can originate from formats like CSV, it must first be processed by Splunk's search pipeline into field-value pairs, which are then converted into JSON documents for insertion into the KV Store. The KV Store itself does not natively ingest or parse XML, CSV, or TXT formats.

B, C, D: These options are incorrect because the KV Store does not natively accept XML, CSV, or TXT formats. Data from these sources must be parsed and transformed into a JSON structure before it can be added to a KV Store collection.

1. Splunk Enterprise Admin Manual

"About the KV Store": This document explicitly states the data format. "The KV Store stores data as key-value pairs in a JSON document format. The data is stored in collections

and is searchable as a lookup." (Splunk Documentation

Admin Manual

Version 9.x

Part of "Use lookups"

Section "About the KV Store").

2. Splunk Enterprise REST API User Manual

"storage/collections/data/{collection}": The documentation for the POST method

used to create records in a collection

specifies that the request body must be in JSON format and requires the Content-Type: application/json header. Example requests consistently show a JSON payload. (Splunk Documentation

REST API User Manual

Version 9.x

Endpoints reference

Section "storage/collections/data/{collection}").

3. Splunk Enterprise Developing Views and Apps for Splunk Web

"An overview of the KV Store": This guide reinforces the core architecture. "The KV Store lets you store and retrieve data within your Splunk apps. The KV Store stores data as key-value pairs in collections. Each collection is a set of records

and each record is a JSON document." (Splunk Documentation

Developing Views and Apps for Splunk Web

Version 9.x

Chapter "Store and retrieve data"

Section "An overview of the KV Store").