topic Re: Lookup File Editor App for Splunk Enterprise: Why am I getting "KV Store is not supported on this version of Splunk"? in All Apps and Add-ons

Lookup File Editor App for Splunk Enterprise: Why am I getting "KV Store is not supported on this version of Splunk"?

parik517 — Tue, 10 Jan 2017 03:42:08 GMT

I am using Splunk 6.5.1 and a clustered search head, and I get the below error when I go to new lookup tab in the app.

KV Store is not supported on this version of Splunk; upgrade to Splunk 6.2 or later for KV Store support.

Re: Lookup File Editor App for Splunk Enterprise: Why am I getting "KV Store is not supported on this version of Splunk"?

richgalloway — Tue, 10 Jan 2017 14:59:02 GMT

Do you have the 32-bit version of Splunk? KV store requires the 64-bit version.

Re: Lookup File Editor App for Splunk Enterprise: Why am I getting "KV Store is not supported on this version of Splunk"?

parik517 — Tue, 10 Jan 2017 16:24:18 GMT

I am using 64-bit version.

Re: Lookup File Editor App for Splunk Enterprise: Why am I getting "KV Store is not supported on this version of Splunk"?

LukeMurphey — Tue, 29 Sep 2020 12:25:40 GMT

Can you try two things:

1) See if there are Javascript errors in the browser console?
2) Try going to /en-US/splunkd/__raw/servicesNS/nobody/-/storage/collections/config?count=-1&output_mode=json and seeing what the output is?

The Lookup Editor attempts to determine if your Splunk install is KV store incapable by seeing if Splunk returns a 404 HTTP response code to that URL (a 404 indicates that the KV store is not available).

Re: Lookup File Editor App for Splunk Enterprise: Why am I getting "KV Store is not supported on this version of Splunk"?

parik517 — Tue, 29 Sep 2020 12:21:27 GMT

1) I see error in browser console like below
en-US/splunkd/_raw/servicesNS/nobody/lookup_editor/storage/collections/config?count=-1&output_mode=json&=1484104023136

Failed to load resource: the server responded with a status of 404 (Not Found)

2) The url which you gave with namespace - works fine however namespace lookup_editor gives below error

{"messages":[{"type":"ERROR","text":"Application does not exist: lookup_editor"}]}

Re: Lookup File Editor App for Splunk Enterprise: Why am I getting "KV Store is not supported on this version of Splunk"?

LukeMurphey — Wed, 11 Jan 2017 06:11:55 GMT

That's strange. I'm not sure why Splunk would say that the app "lookup_editor" doesn't exist given that this is the app making the call. I'm guessing this is some nuance with SHC.

It is easy enough for me to change the call in the Lookup Editor but let me talk to some people to make sure that I understand how SHC is supposed to work in this context so that I can make sure my fix is appropriate.

Re: Lookup File Editor App for Splunk Enterprise: Why am I getting "KV Store is not supported on this version of Splunk"?

LukeMurphey — Wed, 11 Jan 2017 06:17:05 GMT

Given that I have a reasonable suspicion that this is a bug in the app, I went ahead and made a bug ticket to track this: https://lukemurphey.net/issues/1680

Re: Lookup File Editor App for Splunk Enterprise: Why am I getting "KV Store is not supported on this version of Splunk"?

LukeMurphey — Wed, 11 Jan 2017 19:19:47 GMT

Could you try going to the following URL and telling me if you get the same message?

en-US/splunkd/__raw/servicesNS/nobody/lookup_editor/saved/searches

Re: Lookup File Editor App for Splunk Enterprise: Why am I getting "KV Store is not supported on this version of Splunk"?

Venkat_16 — Thu, 12 Jan 2017 05:06:38 GMT

This issue occurs when you change the app folder name to something else.
Restore the original directory name, this should be fixed.

Re: Lookup File Editor App for Splunk Enterprise: Why am I getting "KV Store is not supported on this version of Splunk"?

LukeMurphey — Thu, 12 Jan 2017 05:16:18 GMT

That is definitely true. @parik517: could you confirm that the folder name had been changed?

Re: Lookup File Editor App for Splunk Enterprise: Why am I getting "KV Store is not supported on this version of Splunk"?

parik517 — Thu, 23 Feb 2017 14:03:16 GMT

Yes Folder name has been changed. After correction its working fine.

Re: Lookup File Editor App for Splunk Enterprise: Why am I getting "KV Store is not supported on this version of Splunk"?

LukeMurphey — Thu, 23 Feb 2017 18:30:55 GMT

Ok, I'll post answer to that so that it is clear to other people. I suspect this will happen again since it isn't uncommon for people to rename that app (especially due to the way that deployment server works).

Re: Lookup File Editor App for Splunk Enterprise: Why am I getting "KV Store is not supported on this version of Splunk"?

LukeMurphey — Thu, 23 Feb 2017 18:31:46 GMT

The Lookup Editor currently doesn't support being renamed. It has some static references that will cause it to fail if the name is changed.

I have actually considered supporting renaming but the work isn't trivial. I might do it in the future though.