topic Re: Why am I getting error "The lookup table 'XXX' is invalid" trying to initially populate a kvstore table via outputlookup? in Splunk Search

Why am I getting error "The lookup table 'XXX' is invalid" trying to initially populate a kvstore table via outputlookup?

malat_UoM — Thu, 12 Nov 2015 06:27:12 GMT

First attempt at creating a kvstore lookup to be used by the Search app - initially, at least; I've followed the documentation and defined,

/etc/apps/search/local/collections.conf

[CollectionStanzaName]

/etc/apps/search/local/transforms.conf

[CollectionStanzaName_KVStoreName]
external_type = kvstore
collection = CollectionStanzaName
fields_list = _key, Field1, Field2, Field3, ..., FieldN

Search heads restarted, and subsequent attempts to populate the kvstore using:

<moderately complicated search utilizing search-time transforms> | outputlookup append=t key_field=Unique_Field_Returned_By_Search CollectionStanzaName_KVStoreName

results in error:

Error in 'outputlookup' command: Option 'key_field=Unique_Field_Returned_By_Search' is invalid

If I try to simplify things and run,

    <moderately complicated search utilising search-time transforms> | outputlookup CollectionStanzaName_KVStoreName

I get:

Error in 'outputlookup' command: The lookup table 'CollectionStanzaName_KVStoreName' is invalid.

and searching for these errors draws a blank, so I'm not sure what else to try.

Re: Why am I getting error "The lookup table 'XXX' is invalid" trying to initially populate a kvstore table via outputlookup?

dgladkikh_splun — Thu, 12 Nov 2015 15:14:41 GMT

Which Splunk version are you using?

Re: Why am I getting error "The lookup table 'XXX' is invalid" trying to initially populate a kvstore table via outputlookup?

malat_UoM — Thu, 12 Nov 2015 23:42:15 GMT

Splunk 6.1 - running a search head pool we haven't quite got around to converting into a cluster, so no upgrade to 6.2 yet.

Re: Why am I getting error "The lookup table 'XXX' is invalid" trying to initially populate a kvstore table via outputlookup?

dgladkikh_splun — Fri, 13 Nov 2015 03:31:55 GMT

Ok, KVStore lookups available only starting from version 6.2

Re: Why am I getting error "The lookup table 'XXX' is invalid" trying to initially populate a kvstore table via outputlookup?

malat_UoM — Mon, 16 Nov 2015 05:14:51 GMT

Well, that'll teach us not to upgrade... sorry for wasting your time with such an easy problem...