topic Re: Create KVStore lookup definition in Splunk UI without using transform.conf in Knowledge Management

Create KVStore lookup definition in Splunk UI without using transform.conf

LearningGuy — Sun, 05 May 2024 16:37:05 GMT

Hello,
I am not an admin that has permission to create or view transform.conf file. I also don't have a lab, so I can't experiment with the KVStore lookup.

Can I create KVStore lookup definition in Splunk UI without using transform.conf file?

Will creating KVStore lookup definition in Splunk UI automatically update transform.conf file?

Please suggest. Thank you

Re: Create KVStore lookup definition in Splunk UI without using transform.conf

deepakc — Sun, 05 May 2024 17:45:01 GMT

As you don't have admin access, you have some options:

1. Create the transforms.conf / collections config using a file editor if you know what your doing and give it your Splunk admin they can do the rest.

2. You can download a free instance of Splunk (Install it if you know what your doing) and do the dev work there and then give the config to your Splunk admin.

3. You can also use the lookup editor app - https://splunkbase.splunk.com/app/1724 this is an easy way to create kvstores - you need to install this app and its popular, get you Splunk admin to install this.

Re: Create KVStore lookup definition in Splunk UI without using transform.conf

LearningGuy — Mon, 06 May 2024 03:53:01 GMT

Hello,

Sorry I wasn't clear. I modified my questions a bit below
I was referring Splunk UI as in the menu: Lookups >> Lookup definitions >> Add new
My previous two questions specifically asked about a relationship between Splunk UI and transform.conf (not collection.conf)

1) Can I create KVStore lookup definition in Splunk UI without creating transform.conf file directly via command line?
[Yes/No]

2) Will creating KVStore lookup definition in Splunk UI automatically update transform.conf file?
[Yes/No]

The reason I asked because I only have the ability to create lookup definition through Splunk UI Lookup menu (not lookup editor) and I was wondering if that would create transform.conf

I appreciate your suggestion, here's my response to yours suggestion (although didn't answer my two questions)
1) maybe - but I don't have a way to test
2) PC is restrictive
3) not possible

Thank you

Re: Create KVStore lookup definition in Splunk UI without using transform.conf

isoutamo — Mon, 06 May 2024 07:59:43 GMT

This depends on what you have already in your Splunk. If you want to create KV based lookup with GUI then minimum requirement is that you have at least one collection defined on your instance. And this can do only with conf file. If you haven't any collection then you cannot create kv based lookup with GUI. Of course if you have lookup editor app then you can.

But even if you have collection defined it's not so simple than just create a new lookup based on it. Usually there is collection per lookup as collection defines used fields in lookup.

I think that your best options are:

Ask your Splunk Admin install Splunk Lookup Editor and use it
Ask your Splunk Admin / KO admin create that collection + lookup for you
Create app which contains those and ask from your Splunk Admin that they install it with needed permission for your use case

r. Ismo

Re: Create KVStore lookup definition in Splunk UI without using transform.conf

deepakc — Mon, 06 May 2024 08:20:08 GMT

1) Can I create KVStore lookup definition in Splunk UI without creating transform.conf file directly via command line?
[Yes/No]
Yes (Splunk will create a transforms.conf via the Splunk UI)

2) Will creating KVStore lookup definition in Splunk UI automatically update transform.conf file?
[Yes/No]
Yes - (This sounds like, if you want update your kvstore definitions with perhaps new fields etc, so yes it will automatically update the transforms.conf)

Re: Create KVStore lookup definition in Splunk UI without using transform.conf

LearningGuy — Mon, 06 May 2024 12:04:46 GMT

Hi,

Thanks for answering my questions.
Since I can update transform.conf myself, I only need to an admin to create collections.conf, correct?

Thanks again

Re: Create KVStore lookup definition in Splunk UI without using transform.conf

deepakc — Mon, 06 May 2024 12:50:11 GMT

yes, the Splunk admin can then add it to the correct app context and apply permissions.

Re: Create KVStore lookup definition in Splunk UI without using transform.conf

LearningGuy — Mon, 06 May 2024 19:43:45 GMT

Whenever I update/create collections.conf or transforms.conf file manually , should Splunk need to be restarted (by admin)?

Same question if I use Lookup Editor app - should Splunk need to be restarted (by admin) after updating/creating collections.conf or transforms.conf?

https://splunkbase.splunk.com/app/1724

I think once we have these answered, you have solved this post.

Thank you so much

Re: Create KVStore lookup definition in Splunk UI without using transform.conf

isoutamo — Mon, 06 May 2024 20:23:57 GMT

When you have edited those files on disk, splunk needs restarted or at least refreshed before those change as are in use. You should look /debug/refresh url for refresh.

When you are using lookup editor app, no need to do those as this app manage those actions internally. Just create a new lookup and after you have saved it, it’s ready for use.

Re: Create KVStore lookup definition in Splunk UI without using transform.conf

LearningGuy — Tue, 07 May 2024 14:46:07 GMT

Hi @isoutamo
So if I am using lookup editor, I don't need an intervention from the admin, including restarting or refreshing URL, correct?

Thanks

Re: Create KVStore lookup definition in Splunk UI without using transform.conf

isoutamo — Tue, 07 May 2024 20:31:18 GMT

That’s correct.