topic Re: retention period, license cost, storage location for KV store and other lookups in Installation

retention period, license cost, storage location for KV store and other lookups

Harishma — Sat, 06 Jun 2020 16:04:12 GMT

I read KV store and other lookups dont incur license cost since they're stored on the Search heads. So whats the retention period of KV store lookups and other lookups?

Re: retention period, license cost, storage location for KV store and other lookups

nareshinsvu — Fri, 30 Aug 2019 06:26:09 GMT

Retention is until you delete them on your Splunk instance.

When it comes to License: If your License expires, all your Searches are disabled which might block you to view your lookups using UI. Work around is that you can view the lookup data from the splunk server ($SPLUNK_HOME/etc/apps/search/lookups). But you can't create new lookups in Splunk.

Re: retention period, license cost, storage location for KV store and other lookups

KARANMALHOTRA — Fri, 30 Aug 2019 06:33:47 GMT

This path will only have the csv lookups. $SPLUNK_HOME/etc/apps//lookups

The KV lookups can only be accessed from the UI or via REST API. And that would require a valid license.

Re: retention period, license cost, storage location for KV store and other lookups

Harishma — Mon, 16 Sep 2019 07:24:11 GMT

Thankyou @KARANMALHOTRA and @nareshinsvu