Splunk Apps » Lookup Editor

• Using inputlookup/outputlookup (http://dev.splunk.com/view/webframework-developapps/SP-CAAAEZQ)
• Contact the REST endpoints directly

• Not corrupt the KV store if the schema isn't the same
• Be able to create the backups in the provide location
• Download the entire /var/lib/splunk/kvstore directory (only works if Splunk is shutdown though)

Some links:

• http://docs.splunk.com/Documentation/Splunk/6.2.8/Admin/BackupKVstore
• http://docs.splunk.com/Documentation/ITSI/1.2.0/Configure/BackupandRestoreITSIconfig: how ITSI backs up, restores

Might be able to iterate the JSON with this: https://github.com/kashifrazzaqui/json-streamer

Can outputlookup send data to a sub-directory?

Note that KV store will have entries for multiple users. Somehow, all of these need to be backed up.