All Apps and Add-ons

Duplicate Entries in a KVstore (when rows are pasted into it)

Melstrathdee
Path Finder

I have a kvstore lookup table and I wanted to move data from a kv store in dev to prod. I do this using the LookupFile Editor.
I tried doing an import which failed with an error

"Unable to import the file since the input file is missing the column: xyz"

The tables were identical as they are from the same app just in different environments.

So I tried copying and pasting the cells across manually. Not sure whats happening but says it auto saves but when I refresh or reopen the kvstore i get duplicates and my table goes from 200 entries to 2500 entries.
Its very weird not all entries are duplicated and some are duplicated 7 or 8 times.

Any Ideas
Im using splunk 7.2.4, Lookup Editor 3.3.2, we only have one search head.

Tags (1)
0 Karma

LukeMurphey
Champion

I can help determine what is going on here and put in a fix in the app. There are some things that would help me:

  1. A copy if the file you are attempting to import (even if just a part of the file). You can email me at Luke at LukeMurphey.net if you don't want to post it here.
  2. The collections.conf from both hosts (to determine if the schema is different and how so)
0 Karma

Melstrathdee
Path Finder

Hey Luke,
The kvstore is from the [dashboard assistant app][1]https://splunkbase.splunk.com/app/2947/

I will send you a sample of the file contents.
It consists of a-z A_Z numbers /,.()-_

PROD BOX
the default/collections.conf on bother servers contains
[help_entries]
enforceTypes = true
field.app = string
field.view = string
field.panel = string
field.classification = string
field.text = string
field.app_version = string
field.disabled = bool

DEVBOX
[help_entries]
enforceTypes = true
field.app = string
field.view = string
field.panel = string
field.classification = string
field.text = string
field.app_version = string
field.disabled = bool

Just checked the table in PROD from each app (dashboard assistant and Lookup Editor) and they are out of sync, one has 110 lines, the other has 76.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...