Hi
I have created an app using the Add-on builder, by:
collectionName = "myKVStore"
service = connect(scheme=scheme, host=splunkd_host, port=splunkd_port, token=helper.session_key, owner="nobody")
if not collectionName in service.kvstore:
service.kvstore.create(collectionName)
I would like to see the data in my kvstore, IN Splunk, i have tried to query the api with no luck, also tried to define it transforms.conf:
[myKVstore]
external_type = kvstore
case_sensitive_match = false
collection = myKVstore
fields_list = _key, ....
If i then query it by: |inputlookup ... i get "collection does not exist"
But it works fine within my code
Ideas?
Try to make sure that when you are running the | inputlookup search from the Add-on's search dashboard where the collection is defined.
Collection definition should be present in the collections.conf file
- You can search from the backend of your search with below CLI to find out where the collection has defined.
./splunk btool collections list myKVStore --debug
If you don't see any results that means the error is correct and you do not have collection defined and you need to create a collection first.
If you see the file listed then try to run the | inputlookup search from that App.
Alternatively, you can also look at default.meta or local.meta file to change the permission of the collection and lookup definition(transforms) - https://docs.splunk.com/Documentation/Splunk/8.2.4/Admin/Defaultmetaconf