topic How to transfer existing CSV data to kvstore? in Getting Data In

How to transfer existing CSV data to kvstore?

sandeep_thosar — Thu, 04 Dec 2014 14:00:46 GMT

Hi Team,

I have just installed splunk 6.2 version and need to transfer my existing .csv lookup files to KV store. I have tried lot of things from the net but no luck. Can anybody help me with a solution or useful link where I can get some sample examples?

Thanks in advance.

Sandeep Thosar

Re: How to transfer existing CSV data to kvstore?

gfuente — Thu, 04 Dec 2014 14:01:55 GMT

Here is exactly what you are looking for:

http://dev.splunk.com/view/SP-CAAAEZQ

Good Luck

Re: How to transfer existing CSV data to kvstore?

sandeep_thosar — Thu, 04 Dec 2014 14:08:53 GMT

Hi,

Thanks for the prompt reply. I have already tried link which you mentioned but i have received following error.

Error in 'outputlookup' command: The lookup table 'test' is invalid.

Re: How to transfer existing CSV data to kvstore?

Muryoutaisuu — Thu, 04 Dec 2014 15:31:38 GMT

Hi. this worked for me:

collections.conf

[<collectionname>]

transforms.conf

[<collectionname>_lookup]
external_type = kvstore
collection = <collectionname>
fields_list = _key, <comma separated list of fields>

And then use a command like that:

| inputlookup <yourfile>.csv | outputlookup <collectionname>_lookup

Edit: Example:

collection.conf

[mycoll]

transforms.conf

[mycoll_lookup]
external_type = kvstore
collection = mycoll
fields_list = _key, field1, field2

data.csv

field1,field2
value11,value12
value21,value22
value31,value32

And the command:

| inputlookup data.csv | outputlookup mycoll_lookup

Re: How to transfer existing CSV data to kvstore?

gfuente — Fri, 05 Dec 2014 08:08:56 GMT

Please, post the search you are using...

Re: How to transfer existing CSV data to kvstore?

Muryoutaisuu — Fri, 05 Dec 2014 08:17:51 GMT

Looks to me as if you forgot the transforms.conf stanza

Re: How to transfer existing CSV data to kvstore?

sandeep_thosar — Fri, 05 Dec 2014 09:48:44 GMT

Hi Muryoutaisuu

Thanks for the reply. I have one query where we store collections.conf and transforms.conf file, means on local directory or on somewhere inside Splunk home directory.

Thanks in advance.

Regards,

Sandeep

Re: How to transfer existing CSV data to kvstore?

sandeep_thosar — Fri, 05 Dec 2014 09:51:36 GMT

Hi,

In my scenario i have created one Lookup file (.csv) which contains AccountNo's and from this Lookup file need to insert records into the kvstore_Lookup. Folowing is my search Query.

| inputlookup lkpAttemptByAccount.csv | outputlookup mycollections_lookup

Thanks in Advance.

Regards,

Sandeep