All Apps and Add-ons

Problem with reserved _id KV field

tofa
Explorer

Hi team,

I am running the latest Hurricane Labs Shodan version 2.0.8, but I am getting this error when running the saved search:

03-04-2021 13:50:53.754 ERROR KVStoreLookup - KV Store output failed with err: The _id field is a reserved field and may not be present in a document or query. message: 
03-04-2021 13:50:53.755 ERROR SearchResultsFiles - An error occurred while saving to the KV Store. Look at search.log for more information.
03-04-2021 13:50:53.755 ERROR outputcsv - sid:1614865793.691 Could not write to collection 'shodan_output': An error occurred while saving to the KV Store. Look at search.log for more information..

It looks like that, somehow, an _id field is being generated from the search

tofa_0-1614866434039.png

I could rename it of course, but I do not know how it is going to impact the rest of the app without troubleshooting it so I was wondering, how can I fix it quickly and, eventually, get the app updated to prevent such error on the next iterations?

Thanks and regards!

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...