Splunk Dev

Array and Boolean type in KVStore causes validation errors

MCG_RasmusToelh
Engager

Hi we are using boolean and array as types for our KVStores. It have always worked but causes validation failures in appinspect and errors in search.log.

Changing boolean to bool is easy, but what about array isn't it supported at all?

 

We found the boolean, array and cidr types in the REST kvstore docs: https://docs.splunk.com/Documentation/Splunk/8.1.1/RESTREF/RESTkvstore#Arrays

 

But these developer docs says only 'number | bool | string | time ) ' is allowed:

https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/kvstore/usingconfigurationfiles

 

So how and where can we use the Array type?

 

08-19-2020 08:58:41.873 +0200 ERROR CollectionConfigurationProvider - Invalid field type='boolean' for field='enabled' in collection='ux_applications' and app='mcg_uxm'
08-19-2020 08:58:41.873 +0200 ERROR CollectionConfigurationProvider - Invalid field type='array' for field='processes' in collection='ux_applications' and app='mcg_uxm'
08-19-2020 08:58:41.873 +0200 ERROR CollectionConfigurationProvider - Invalid field type='array' for field='tags' in collection='ux_applications' and app='mcg_uxm'

 

 

collections.conf

[ux_applications]
field.name = string
field.customer = string
field.contact = string
field.external_analysis_link_url = string
field.external_analysis_link_name = string
field.external_trace_link_url = string
field.external_trace_link_name = string
field.type = string
field.storage_used_mb = string
field.storage_quota_mb = string
field.tags = array
field.processes = array
field.enabled = boolean
replicate = true
Labels (1)
0 Karma
1 Solution

manjunathmeti
SplunkTrust
SplunkTrust

hi @MCG_RasmusToelh ,

 

Only data types number, bool, string, and time are enforced on the field values. The array type is not enforceable so does not need to be specified. 

Below statement is from collections.conf documentation

field.<name> = number|bool|string|time
* Field type for a field called <name>.
* If the data type is not provided, the data type is inferred from the provided JSON data type.

View solution in original post

manjunathmeti
SplunkTrust
SplunkTrust

hi @MCG_RasmusToelh ,

 

Only data types number, bool, string, and time are enforced on the field values. The array type is not enforceable so does not need to be specified. 

Below statement is from collections.conf documentation

field.<name> = number|bool|string|time
* Field type for a field called <name>.
* If the data type is not provided, the data type is inferred from the provided JSON data type.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...