All Apps and Add-ons

Duplicate Entries in a KVstore (when rows are pasted into it)

Melstrathdee
Path Finder

I have a kvstore lookup table and I wanted to move data from a kv store in dev to prod. I do this using the LookupFile Editor.
I tried doing an import which failed with an error

"Unable to import the file since the input file is missing the column: xyz"

The tables were identical as they are from the same app just in different environments.

So I tried copying and pasting the cells across manually. Not sure whats happening but says it auto saves but when I refresh or reopen the kvstore i get duplicates and my table goes from 200 entries to 2500 entries.
Its very weird not all entries are duplicated and some are duplicated 7 or 8 times.

Any Ideas
Im using splunk 7.2.4, Lookup Editor 3.3.2, we only have one search head.

Tags (1)
0 Karma

LukeMurphey
Champion

I can help determine what is going on here and put in a fix in the app. There are some things that would help me:

  1. A copy if the file you are attempting to import (even if just a part of the file). You can email me at Luke at LukeMurphey.net if you don't want to post it here.
  2. The collections.conf from both hosts (to determine if the schema is different and how so)
0 Karma

Melstrathdee
Path Finder

Hey Luke,
The kvstore is from the [dashboard assistant app][1]https://splunkbase.splunk.com/app/2947/

I will send you a sample of the file contents.
It consists of a-z A_Z numbers /,.()-_

PROD BOX
the default/collections.conf on bother servers contains
[help_entries]
enforceTypes = true
field.app = string
field.view = string
field.panel = string
field.classification = string
field.text = string
field.app_version = string
field.disabled = bool

DEVBOX
[help_entries]
enforceTypes = true
field.app = string
field.view = string
field.panel = string
field.classification = string
field.text = string
field.app_version = string
field.disabled = bool

Just checked the table in PROD from each app (dashboard assistant and Lookup Editor) and they are out of sync, one has 110 lines, the other has 76.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...