topic Re: After editing the KV Store for my custom app, why do I receive error "The lookup table is invalid" when using the inputlookup command? in Getting Data In

After editing the KV Store for my custom app, why do I receive error "The lookup table is invalid" when using the inputlookup command?

493669 — Sat, 25 Mar 2017 17:12:29 GMT

Hi,
In Splunk 6.4.5 standalone on Windows. After creating an app, I added a stanza in transforms.conf and collections.conf in default folder. Then after adding few entries in that KV Store i am able to see through |inputlookup command
Then i added transforms.conf and collections.conf in the local folder of the app and then added stanza for KV Store, but when i tried |inputlookup command it gives me error as "The lookup table is invalid".
Please advise.

Re: After editing the KV Store for my custom app, why do I receive error "The lookup table is invalid" when using the inputlookup command?

starcher — Sat, 25 Mar 2017 17:28:57 GMT

If you provide your config stanzas it would be easier for someone to provide some guidance.

Re: After editing the KV Store for my custom app, why do I receive error "The lookup table is invalid" when using the inputlookup command?

493669 — Tue, 29 Sep 2020 13:24:19 GMT

in Local folder-
Collections.conf
[sample]
field.test = string
field.check = string
replicate = true

Transforms.conf
[sample_store]
external_type = kvstore
collection = sample
fields_list = test, check

Re: After editing the KV Store for my custom app, why do I receive error "The lookup table is invalid" when using the inputlookup command?

woodcock — Tue, 28 Mar 2017 22:47:35 GMT

Pick an question and stick to it; do not keep opening the same question over and over.

Re: After editing the KV Store for my custom app, why do I receive error "The lookup table is invalid" when using the inputlookup command?

woodcock — Tue, 28 Mar 2017 22:48:06 GMT

You should DEFINITELY open a support case. Be sure to followup and let us all know what the conclusion/fix turns out to be.

Re: After editing the KV Store for my custom app, why do I receive error "The lookup table is invalid" when using the inputlookup command?

493669 — Sat, 01 Apr 2017 12:20:53 GMT

I am unable to open support case as it shows "It appears you do not have an active Support Contract or entitlement and as a result, cannot open a Support case."

Re: After editing the KV Store for my custom app, why do I receive error "The lookup table is invalid" when using the inputlookup command?

woodcock — Sat, 01 Apr 2017 19:03:51 GMT

If you go to transforms.conf and change this:

[sample_store]

to this:

[sample]

then it will work (or at least it did for me). You could make the opposite change in collections.conf; the point is that when you make both stanza headers match, then it works. I could not find any documentation stating that the names must match, and, as we both discovered, Splunk does not complain upon instantiation if they do not, but it does complain when you try to read/write to the lookup.

Re: After editing the KV Store for my custom app, why do I receive error "The lookup table is invalid" when using the inputlookup command?

493669 — Sun, 02 Apr 2017 03:05:32 GMT

after making same header stanza for both transforms.conf and collection.conf still gives me error as "The lookup table 'sample' is invalid".
when i tried to create kv store through lookup definition it is get created but unable to set permission from private to global. it gives error as "Splunk could not update permissions for resource data/transforms/lookups [HTTP 500] Splunkd internal error; [{'type': 'ERROR', 'code': None, 'text': "\n In handler 'transforms-lookup': Data could not be written: /nobody/Test/transforms/ui/fields_list: ui, collectionName, app"}"

Re: After editing the KV Store for my custom app, why do I receive error "The lookup table is invalid" when using the inputlookup command?

woodcock — Sun, 02 Apr 2017 13:18:02 GMT

From the CLI, inside the app where the collection exists, create default.meta file in the metadata directory with this:

[collections]
export = system
[lookups]
export = system

Then manually remove any entries that you have for sample from your local.meta file. I don't know why the GUI would be having problems but it may be because these 2 files do not have the correct ownership or permissions.

Re: After editing the KV Store for my custom app, why do I receive error "The lookup table is invalid" when using the inputlookup command?

493669 — Sun, 02 Apr 2017 17:02:16 GMT

added below stanza in default.meta :

 [collections]
export = system

and

[lookups]
 export = system

this stanza already present.
checked local.meta but i did not find any sample entry .below stanza are present in local.meta

[app/ui]
version = 6.4.5
modtime = 1491051965.784553700

[app/launcher]
version = 6.4.5
modtime = 1491051965.929988500

still gives same error

Re: After editing the KV Store for my custom app, why do I receive error "The lookup table is invalid" when using the inputlookup command?

woodcock — Sun, 02 Apr 2017 17:16:12 GMT

Did you hit the debug/refresh endpoint or restart splunk on the Search Head?

Re: After editing the KV Store for my custom app, why do I receive error "The lookup table is invalid" when using the inputlookup command?

493669 — Mon, 03 Apr 2017 15:50:00 GMT

After debug/refresh i get following errors:
1.

Refreshing admin/crl                       ResourceNotFound 
 In handler 'crl': Invalid action for this internal handler (handler: crl, supported: list|_reload, wanted: list).

Refreshing admin/remote_indexes            BadRequest 
 In handler 'remote_indexes': The following required arguments are missing: repositoryLocation.

Re: After editing the KV Store for my custom app, why do I receive error "The lookup table is invalid" when using the inputlookup command?

woodcock — Tue, 04 Apr 2017 00:58:56 GMT

Those 2 errors are normal; I always see them, even on a fresh install so that is not it. After the debug/refresh, are you still getting some search |outputlookup errors (forget about |inputlookup until we get outputlookup working)?

Re: After editing the KV Store for my custom app, why do I receive error "The lookup table is invalid" when using the inputlookup command?

493669 — Tue, 04 Apr 2017 02:49:38 GMT

After trying ...|outputlookup sample get same error as

"Error in 'outputlookup' command: The
lookup table 'sample' is invalid."

Re: After editing the KV Store for my custom app, why do I receive error "The lookup table is invalid" when using the inputlookup command?

MuS — Tue, 04 Apr 2017 03:31:46 GMT

Hi 493669,

Since you've never provided the actual search command you used, I wonder if you use the stanza name set in collections.conf instead the one from transforms.conf?

I took your posted config files and it works just fine:

After adding some random values to it I can get them back as well using the stanza name from transforms.conf:

Where as I get the same error as you got when using |inputlookup sample.

Here are the config files used:

collections.conf

[sample]
field.test = string
field.check = string
replicate = true

transforms.conf

[sample_store]
external_type = kvstore
collection = sample
fields_list = test, check

Hope this helps ...

cheers, MuS

Re: After editing the KV Store for my custom app, why do I receive error "The lookup table is invalid" when using the inputlookup command?

493669 — Tue, 04 Apr 2017 15:21:20 GMT

Hi MuS,
When I am trying |inputlookup command I am using transforms.conf stanza name only . As @woodcock suggested to make both header stanza same in transforms.conf and collections.conf so tried with |inputlookup sample but it not worked.
now i tried the stanza provided and tried |inputlookup sample_store but still it gives error as

The lookup table 'sample_store' is
invalid.

Re: After editing the KV Store for my custom app, why do I receive error "The lookup table is invalid" when using the inputlookup command?

MuS — Tue, 04 Apr 2017 19:58:19 GMT

Hi 493669, if you want I email you and we can solve this offline?

Re: After editing the KV Store for my custom app, why do I receive error "The lookup table is invalid" when using the inputlookup command?

493669 — Wed, 05 Apr 2017 01:29:41 GMT

yes sure...

Re: After editing the KV Store for my custom app, why do I receive error "The lookup table is invalid" when using the inputlookup command?

493669 — Sat, 15 Apr 2017 10:17:21 GMT

Finally issue is resolved now. It was permission issue on my windows as suggested.
On Splunk Folder >Propperties>Security Tab>Advanced>In Advanced Security Settings>Given Full Control Access for particular User-Admin and tick on checkbox-"Replace all child object permission entries with inheritable permission entries from this object".
Then Apply these settings.
Thanks @MuS @woodcock and @mattymo

Re: After editing the KV Store for my custom app, why do I receive error "The lookup table is invalid" when using the inputlookup command?

MuS — Sat, 15 Apr 2017 21:06:28 GMT

Happy you were able to resolve this issue. Feel free to vote for any other answer or comment that helped you with this problem, especially for those who helped out offline 😉

cheers, MuS