topic Re: How do I set up a KV Store lookup? in Getting Data In

How do I set up a KV Store lookup?

danielbb — Wed, 09 Apr 2025 18:09:57 GMT

I created a KV Store lookup using the "Splunk App for Lookup File Editing" app, however when I look at Settings>Lookups, the lookup definition doesn't show up. In addition, when running

| inputlookup <name>

I get the error "The lookup table '<name>' requires a .csv or KV store lookup definition"

What do I miss?

Re: How do I set up a KV Store lookup?

PickleRick — Wed, 09 Apr 2025 18:16:25 GMT

Typically that's a result of wrong scope or insufficient access - your lookup is either private or exported only to the app you've created it in but you're searching from another app (typically the search app)

Re: How do I set up a KV Store lookup?

livehybrid — Wed, 09 Apr 2025 22:05:01 GMT

HI @danielbb

You need to create the lookup definition once you have created the KV Store collection in the lookup editor app.

Go to Settings->Lookups->Lookup Definitions.

Create a new one as below - filling in the relevant details:

Then you should be able to search it using |inputlookup

Note: I generally try and call the definition something different to the collection/kv store name but you do not need to.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: How do I set up a KV Store lookup?

isoutamo — Wed, 09 Apr 2025 22:27:55 GMT

This is most common issue if you don’t see and can’t use it from other options.
I’m not sure/haven’t checked I last times what options you can set with this app. In most cases with small or mid sized lookups this works (enough) well, but if you have huge ones and/or you are needing e.g. accelerations then it’s easier to define those via conf files.

Re: How do I set up a KV Store lookup?

danielbb — Fri, 11 Apr 2025 16:08:30 GMT

Thank you @PickleRick, it was a confusion about the app where the collection and the definition exist.