KVStore Field returning Invalid result- How do I fix this?

rjscholl — Wed, 16 Mar 2022 18:01:15 GMT

Hello.

I have some KVStore collections in our cloud environment. In some of those collections, there are boolean fields that I want to use with search logic. Examples are called "curbside.disabled" and "curbside.offered". I want to be able to say if curbside.offered is true, add 1 to a totalOffered field so I can get a count of all offered items offered and all items disabled. Then I can do some math on those. Each time I try to use one of those fields, the search failed. When I assign a temp field to typeof(curbside.disabled), etc. it returns "invalid". The kvstores were created in Lookup Editor and lookup definitions are created. I can see the fields and table them. I can't use the data in them. What am I doing wrong?

Re: KVStore Field returning Invalid result- How do I fix this?

rjscholl — Wed, 16 Mar 2022 18:53:10 GMT

I have it working by putting $ before and after the field name.

topic KVStore Field returning Invalid result- How do I fix this? in Splunk Search

KVStore Field returning Invalid result- How do I fix this?

Re: KVStore Field returning Invalid result- How do I fix this?