get_kvstore_data
Retrieve documents from Splunk KV Store collections using optional MongoDB-style queries to filter lookup data, configuration settings, or field-specific results based on user permissions.
Instructions
Get documents from a KV Store collection with optional MongoDB-style query filtering. Use this to fetch lookup/configuration data or narrow results by field values.
Args: collection (str): Collection name app (str, optional): App where the collection resides (defaults to current/app context) query (object, optional): MongoDB-style filter object (e.g., {"status": "active"})
Outputs: 'documents' array and 'count'. Security: access and results are constrained by the authenticated user's permissions.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| collection | Yes | ||
| app | No | ||
| query | No |