I have a kvstore lookup table and I wanted to move data from a kv store in dev to prod. I do this using the LookupFile Editor.
I tried doing an import which failed with an error
"Unable to import the file since the input file is missing the column: xyz"
The tables were identical as they are from the same app just in different environments.
So I tried copying and pasting the cells across manually. Not sure whats happening but says it auto saves but when I refresh or reopen the kvstore i get duplicates and my table goes from 200 entries to 2500 entries.
Its very weird not all entries are duplicated and some are duplicated 7 or 8 times.
Any Ideas
Im using splunk 7.2.4, Lookup Editor 3.3.2, we only have one search head.
I can help determine what is going on here and put in a fix in the app. There are some things that would help me:
Hey Luke,
The kvstore is from the [dashboard assistant app][1]https://splunkbase.splunk.com/app/2947/
I will send you a sample of the file contents.
It consists of a-z A_Z numbers /,.()-_
PROD BOX
the default/collections.conf on bother servers contains
[help_entries]
enforceTypes = true
field.app = string
field.view = string
field.panel = string
field.classification = string
field.text = string
field.app_version = string
field.disabled = bool
DEVBOX
[help_entries]
enforceTypes = true
field.app = string
field.view = string
field.panel = string
field.classification = string
field.text = string
field.app_version = string
field.disabled = bool
Just checked the table in PROD from each app (dashboard assistant and Lookup Editor) and they are out of sync, one has 110 lines, the other has 76.