https://community.splunk.com/t5/Knowledge-Management/Are-characters-in-KV-lookup-field-names-supported/m-p/380048#M3254 <P>According to <A href="https://docs.mongodb.com/manual/reference/limits/">mongodb</A> </P> <PRE><CODE> Restrictions on Field Names Field names cannot contain the null character. Top-level field names cannot start with the dollar sign ($) character. Otherwise, starting in MongoDB 3.6, the server permits storage of field names that contain dots (i.e. .) and dollar signs (i.e. $). </CODE></PRE> <P>I know Splunk 7 uses an older version of mongodb (3.4 perhaps), I believe Splunk 7.2.x uses 3.6 but I also could not use "." characters in field names in that version, so I suspect you will need to avoid the $ symbol and the . symbol is field names via kvstore.</P> Sun, 11 Nov 2018 22:22:34 GMT gjanders 2018-11-11T22:22:34Z https://community.splunk.com/t5/Knowledge-Management/Are-characters-in-KV-lookup-field-names-supported/m-p/380047#M3253 <P>I notice that whenever I create a KV-store lookup definition with a field containing a '.' character, it does not work properly. Surrounding the fieldname with """ does not help.</P> <P>Writing to the lookup with the outputlookup command results in the message:<BR /> "Could not write to collection 'my_collection': An error occurred while saving to the KV Store.</P> <P>When I remove the '.' character(s) from the field names in de lookup definition it works again.</P> Thu, 08 Nov 2018 13:50:05 GMT https://community.splunk.com/t5/Knowledge-Management/Are-characters-in-KV-lookup-field-names-supported/m-p/380047#M3253 jthunnissen 2018-11-08T13:50:05Z https://community.splunk.com/t5/Knowledge-Management/Are-characters-in-KV-lookup-field-names-supported/m-p/380048#M3254 <P>According to <A href="https://docs.mongodb.com/manual/reference/limits/">mongodb</A> </P> <PRE><CODE> Restrictions on Field Names Field names cannot contain the null character. Top-level field names cannot start with the dollar sign ($) character. Otherwise, starting in MongoDB 3.6, the server permits storage of field names that contain dots (i.e. .) and dollar signs (i.e. $). </CODE></PRE> <P>I know Splunk 7 uses an older version of mongodb (3.4 perhaps), I believe Splunk 7.2.x uses 3.6 but I also could not use "." characters in field names in that version, so I suspect you will need to avoid the $ symbol and the . symbol is field names via kvstore.</P> Sun, 11 Nov 2018 22:22:34 GMT https://community.splunk.com/t5/Knowledge-Management/Are-characters-in-KV-lookup-field-names-supported/m-p/380048#M3254 gjanders 2018-11-11T22:22:34Z