All Apps and Add-ons

where splunk kv store data has been stored in splunk ?


I'm new to splunk, i have couple of questions related to kv store.
use case 1:
i have created splunk app using splunk python sdk app name called "test_kvstore" and created one kv store name "test_data_kvstore" and added data to it aswell (using python sdk).
next i have defined kvlookup in splunk search head (web ui & gave global permission) then i just try to see the kvstore data in splunk search head so put this command in search head
|inputlookup test_data_kvlookup
getting this error in search head.
Error in 'inputlookup' command: Lookup failed because collection 'test_data_kvstore' in app 'test_kvstore' does not exist, or user 'manikandankasi' does not have read access

i couldn't get why im getting this error since the app and kvstore already defined.

is it kvstore data specific to the app or its stored globally?
if i want see the test_data_kvstore then by default where its stored? and location?

any help on this much appriciated !!!

Thanks in Advance,

Tags (1)
0 Karma

Super Champion

Hi @manikandankasi,

If you're new to Splunk I would advise you start by reading here to get some info about how the kv-store works and how to manage it to avoid having issues as it scales:

Now on to you question, the location of the kvstore is in $SPLUNK_HOME/var/lib/splunk/kvstore and can easily be backed up in case you're worried about losing your data :

As for creating a collection, you can follow one of those links :

So yeah your configuration for collection.conf and transforms.conf is correct, you can also add the _keyfield to your list of fields in case you wish to be able to modify some of the event later on via rest or SPL query.

PS: you can use this app for managing your kvstore, makes life way easier




Splunk stores KVStore data in $SPLUNK_HOME/var/lib/splunk/kvstore directory, KVStore uses mongodb so in given directory you will able to find mongo directory and many more files in that directory which belongs to mongodb.

Have you created Lookup Definitions for KVStore on search head ?

0 Karma


yes i have created lookup in search head. these are the definitions for lookup under app/test_kvstore/local directory
filename: transforms.conf

collection = test_data_kvstore
external_type = kvstore
fields_list = field1,field2,field3

filename: collection.conf


did i missed anything in the configuration ? please advise me


0 Karma
Get Updates on the Splunk Community!

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...

Splunk Observability Cloud | Enhancing Your Onboarding Experience with the ...

We understand that your initial experience with getting data into Splunk Observability Cloud is crucial as it ...