https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-have-a-KV-Store-time-based-lookup/m-p/277445#M83667 <P>Hi,</P> <P>That issue is the exact same I have, and it appears there is still no answer for that....</P> Thu, 02 Jun 2016 09:38:49 GMT TiagoMatos 2016-06-02T09:38:49Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-have-a-KV-Store-time-based-lookup/m-p/277443#M83665 <P>Hi,</P> <P>I have a kvstore defined based on a collection</P> <P>collections.conf</P> <PRE><CODE>[app2] </CODE></PRE> <P>transforms.conf</P> <PRE><CODE>[business_id2] collection = app2 external_type = kvstore fields_list = _key, LAST_UPD, MY_TIME, PROPERTY, ROW_ID, TYPE, VALUE max_matches = 1000 min_matches = 0 min_offset_secs = 0 time_field = MY_TIME </CODE></PRE> <P>I also have another lookup table that has the exact same results BUT IS NOT A KVSTORE (it is file-based):</P> <PRE><CODE>[Business_ID] filename = Business_ID.csv max_matches = 1000 min_matches = 0 min_offset_secs = 0 time_field = MY_TIME time_format = %Y-%m-%d %H:%M:%S </CODE></PRE> <P>When doing something like</P> <PRE><CODE>index=A | lookup business_id2 ROW_ID OUTPUT VALUE </CODE></PRE> <P>I get no VALUE column.</P> <P>When doing:</P> <PRE><CODE>index=A | lookup Business_ID ROW_ID OUTPUT VALUE </CODE></PRE> <P>I get the VALUE column....</P> <P>SO it seems a KV Store doesn't have Time Based capability... it it true?</P> <P>Thanks</P> Wed, 01 Jun 2016 14:50:29 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-have-a-KV-Store-time-based-lookup/m-p/277443#M83665 TiagoMatos 2016-06-01T14:50:29Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-have-a-KV-Store-time-based-lookup/m-p/277444#M83666 <P>Check this to see if it helps. At least it answers yes to time based kvstore lookups<BR /> <A href="https://answers.splunk.com/answers/209693/time-based-lookups-and-kvstore.html">https://answers.splunk.com/answers/209693/time-based-lookups-and-kvstore.html</A></P> Wed, 01 Jun 2016 14:56:40 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-have-a-KV-Store-time-based-lookup/m-p/277444#M83666 kbrown_splunk 2016-06-01T14:56:40Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-have-a-KV-Store-time-based-lookup/m-p/277445#M83667 <P>Hi,</P> <P>That issue is the exact same I have, and it appears there is still no answer for that....</P> Thu, 02 Jun 2016 09:38:49 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-have-a-KV-Store-time-based-lookup/m-p/277445#M83667 TiagoMatos 2016-06-02T09:38:49Z