Lookup File Editor App for Splunk Enterprise: Why am I getting "KV Store is not supported on this version of Splunk"?

[parik517]

I am using Splunk 6.5.1 and a clustered search head, and I get the below error when I go to new lookup tab in the app.

KV Store is not supported on this version of Splunk; upgrade to Splunk 6.2 or later for KV Store support.

[LukeMurphey]

The Lookup Editor currently doesn't support being renamed. It has some static references that will cause it to fail if the name is changed.

I have actually considered supporting renaming but the work isn't trivial. I might do it in the future though.

[LukeMurphey]

Can you try two things:

1) See if there are Javascript errors in the browser console?
2) Try going to /en-US/splunkd/__raw/servicesNS/nobody/-/storage/collections/config?count=-1&output_mode=json and seeing what the output is?

The Lookup Editor attempts to determine if your Splunk install is KV store incapable by seeing if Splunk returns a 404 HTTP response code to that URL (a 404 indicates that the KV store is not available).

[parik517]

1) I see error in browser console like below
en-US/splunkd/_raw/servicesNS/nobody/lookup_editor/storage/collections/config?count=-1&output_mode=json&=1484104023136

Failed to load resource: the server responded with a status of 404 (Not Found)

2) The url which you gave with namespace - works fine however namespace lookup_editor gives below error

{"messages":[{"type":"ERROR","text":"Application does not exist: lookup_editor"}]}

[LukeMurphey]

Could you try going to the following URL and telling me if you get the same message?

en-US/splunkd/__raw/servicesNS/nobody/lookup_editor/saved/searches

[LukeMurphey]

That's strange. I'm not sure why Splunk would say that the app "lookup_editor" doesn't exist given that this is the app making the call. I'm guessing this is some nuance with SHC.

It is easy enough for me to change the call in the Lookup Editor but let me talk to some people to make sure that I understand how SHC is supposed to work in this context so that I can make sure my fix is appropriate.

[Venkat_16]

This issue occurs when you change the app folder name to something else.
Restore the original directory name, this should be fixed.

[LukeMurphey]

That is definitely true. @parik517: could you confirm that the folder name had been changed?

[parik517]

Yes Folder name has been changed. After correction its working fine.

[LukeMurphey]

Ok, I'll post answer to that so that it is clear to other people. I suspect this will happen again since it isn't uncommon for people to rename that app (especially due to the way that deployment server works).

[LukeMurphey]

Given that I have a reasonable suspicion that this is a bug in the app, I went ahead and made a bug ticket to track this: https://lukemurphey.net/issues/1680

[richgalloway]

Do you have the 32-bit version of Splunk? KV store requires the 64-bit version.

[parik517]

I am using 64-bit version.