topic Re: How do I locate KVstore & scripted based look ups? in Getting Data In

How do I locate KVstore & scripted based look ups?

SamHTexas — Sun, 21 Mar 2021 20:27:33 GMT

Under lookups I see a few .csv based & few look up definitions. So where are the KVstore based or scripted based lookups located or are they created manually?

Re: How do I locate KVstore & scripted based look ups?

gcusello — Mon, 22 Mar 2021 07:10:23 GMT

Hi @SamHTexas,

all the lookups (file, kv-store, script, etc...) are located on the Search Heads in:

the lookups folder of each app,
the $SPLUNK_HOME/etc/system/default folder,
the $SPLUNK_HOME/etc/system/local folder,
in the user folders ($SPLUNK_HOME/etc/user/<user_name>/<app>).

if you see few lookups, use a different filter because by default lookups are filtered by app in the dashboard.

Ciao and happy splunking.

Giuseppe

Re: How do I locate KVstore & scripted based look ups?

SamHTexas — Thu, 25 Mar 2021 01:56:17 GMT

Grazie, I see my .csv files under the definitions & located some scripts also there via a SH GUI. How about KSstores? Do they have to be edited via CLI?