All Apps and Add-ons

Duplicate Entries in a KVstore (when rows are pasted into it)

Melstrathdee
Path Finder

I have a kvstore lookup table and I wanted to move data from a kv store in dev to prod. I do this using the LookupFile Editor.
I tried doing an import which failed with an error

"Unable to import the file since the input file is missing the column: xyz"

The tables were identical as they are from the same app just in different environments.

So I tried copying and pasting the cells across manually. Not sure whats happening but says it auto saves but when I refresh or reopen the kvstore i get duplicates and my table goes from 200 entries to 2500 entries.
Its very weird not all entries are duplicated and some are duplicated 7 or 8 times.

Any Ideas
Im using splunk 7.2.4, Lookup Editor 3.3.2, we only have one search head.

Tags (1)
0 Karma

LukeMurphey
Champion

I can help determine what is going on here and put in a fix in the app. There are some things that would help me:

  1. A copy if the file you are attempting to import (even if just a part of the file). You can email me at Luke at LukeMurphey.net if you don't want to post it here.
  2. The collections.conf from both hosts (to determine if the schema is different and how so)
0 Karma

Melstrathdee
Path Finder

Hey Luke,
The kvstore is from the [dashboard assistant app][1]https://splunkbase.splunk.com/app/2947/

I will send you a sample of the file contents.
It consists of a-z A_Z numbers /,.()-_

PROD BOX
the default/collections.conf on bother servers contains
[help_entries]
enforceTypes = true
field.app = string
field.view = string
field.panel = string
field.classification = string
field.text = string
field.app_version = string
field.disabled = bool

DEVBOX
[help_entries]
enforceTypes = true
field.app = string
field.view = string
field.panel = string
field.classification = string
field.text = string
field.app_version = string
field.disabled = bool

Just checked the table in PROD from each app (dashboard assistant and Lookup Editor) and they are out of sync, one has 110 lines, the other has 76.

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...