topic Re: How come when I run inputlookup myLookupTest, it's returning 0 results? in Knowledge Management

How come when I run inputlookup myLookupTest, it's returning 0 results?

bbritten — Thu, 27 Dec 2018 15:49:57 GMT

I created a test KVStore in order to familiarize myself with the API. It has about 20 records in it, all of which are listed under the user nobody (viewable from search). However, when running |inputlookup myLookupTest, I get 0 results despite being in the same app in which the KVStore is visible.

Any idea why that might be the case?

Re: How come when I run inputlookup myLookupTest, it's returning 0 results?

p_gurav — Fri, 28 Dec 2018 04:23:23 GMT

Can you tell what permission you set for kvstore collection?

Re: How come when I run inputlookup myLookupTest, it's returning 0 results?

bbritten — Tue, 29 Sep 2020 22:33:04 GMT

@p_gurav The permissions are {"read": "everyone", "write": "soc_elevated"}

Re: How come when I run inputlookup myLookupTest, it's returning 0 results?

niketn — Sat, 29 Dec 2018 03:28:38 GMT

@bbritten did you check Search Job Inspector and also search.log? Any additional information there?
For testing can you create few rows and test outputlookup command if that works?

Re: How come when I run inputlookup myLookupTest, it's returning 0 results?

bbritten — Wed, 02 Jan 2019 18:16:48 GMT

Looking in the Search Job Inspector, I see that it gives the following message: warn: myLookupTest is invalid If go to the Settings drop-down menu item and select Lookups, I'm also unable to find it in the Lookup Files or Lookup Definitions. The only place I can find it is if I go to the Lookup Editor app and search for it there. Did I perhaps create the lookup in the wrong place?

Re: How come when I run inputlookup myLookupTest, it's returning 0 results?

Vijeta — Wed, 02 Jan 2019 18:37:50 GMT

Did you define the KV store using lookup editor, what is your KV store name and did you create a lookup from Settings->lookups->Lookup->lookup definitions and create with Type as KV store and give lookup file name as your KV store name.

Re: How come when I run inputlookup myLookupTest, it's returning 0 results?

bbritten — Wed, 02 Jan 2019 18:42:22 GMT

Did you define the KV store using lookup editor? yes
What is your KV store name? This is different from the collection name, right? I'm not sure of the store name (I'm brand new to Splunk). The collection name is bbrittenKVTest
Did you create a lookup from Settings -> Lookup -> Lookup Definitions? no
Did you create it with type as KV and give the lookup file name as your KV store name? no

It sounds like this is what I need to do.

Re: How come when I run inputlookup myLookupTest, it's returning 0 results?

Vijeta — Wed, 02 Jan 2019 18:44:25 GMT

Collection name is what I was referring to as KV store name, that is what you need to put when you define your lookup.

Re: How come when I run inputlookup myLookupTest, it's returning 0 results?

bbritten — Wed, 02 Jan 2019 18:51:36 GMT

You're amazing! All I had to do was add the definition in Settings -> Lookup -> Lookup Definition and I was able to query the lookup table.

You've already solved my problem, but would you mind providing a little more detail for my own edification? Why does a definition need to be provided? Why wasn't Splunk able to just return the results without it?

Thank you again for your help!