After editing the KV Store for my custom app, why do I receive error "The lookup table is invalid" when using the inputlookup command?

[493669]

Hi,
In Splunk 6.4.5 standalone on Windows. After creating an app, I added a stanza in transforms.conf and collections.conf in default folder. Then after adding few entries in that KV Store i am able to see through |inputlookup command
Then i added transforms.conf and collections.conf in the local folder of the app and then added stanza for KV Store, but when i tried |inputlookup command it gives me error as "The lookup table is invalid".
Please advise.

[493669 · Accepted solution]

Finally issue is resolved now. It was permission issue on my windows as suggested.
On Splunk Folder >Propperties>Security Tab>Advanced>In Advanced Security Settings>Given Full Control Access for particular User-Admin and tick on checkbox-"Replace all child object permission entries with inheritable permission entries from this object".
Then Apply these settings.
Thanks @MuS @woodcock and @mattymo

[MuS]

Happy you were able to resolve this issue. Feel free to vote for any other answer or comment that helped you with this problem, especially for those who helped out offline 😉

cheers, MuS

[MuS]

Hi 493669,

Since you've never provided the actual search command you used, I wonder if you use the stanza name set in collections.conf instead the one from transforms.conf?

I took your posted config files and it works just fine:

After adding some random values to it I can get them back as well using the stanza name from transforms.conf:

Where as I get the same error as you got when using |inputlookup sample.

Here are the config files used:

collections.conf

[sample]
field.test = string
field.check = string
replicate = true

transforms.conf

[sample_store]
external_type = kvstore
collection = sample
fields_list = test, check

Hope this helps ...

cheers, MuS

[493669]

Hi MuS,
When I am trying |inputlookup command I am using transforms.conf stanza name only . As @woodcock suggested to make both header stanza same in transforms.conf and collections.conf so tried with |inputlookup sample but it not worked.
now i tried the stanza provided and tried |inputlookup sample_store but still it gives error as

The lookup table 'sample_store' is
invalid.

[MuS]

Hi 493669, if you want I email you and we can solve this offline?

[493669]

yes sure...

[woodcock]

If you go to transforms.conf and change this:

[sample_store]

to this:

[sample]

then it will work (or at least it did for me). You could make the opposite change in collections.conf; the point is that when you make both stanza headers match, then it works. I could not find any documentation stating that the names must match, and, as we both discovered, Splunk does not complain upon instantiation if they do not, but it does complain when you try to read/write to the lookup.

[493669]

after making same header stanza for both transforms.conf and collection.conf still gives me error as "The lookup table 'sample' is invalid".
when i tried to create kv store through lookup definition it is get created but unable to set permission from private to global. it gives error as "Splunk could not update permissions for resource data/transforms/lookups [HTTP 500] Splunkd internal error; [{'type': 'ERROR', 'code': None, 'text': "\n In handler 'transforms-lookup': Data could not be written: /nobody/Test/transforms/ui/fields_list: ui, collectionName, app"}"

[woodcock]

From the CLI, inside the app where the collection exists, create default.meta file in the metadata directory with this:

[collections]
export = system
[lookups]
export = system

Then manually remove any entries that you have for sample from your local.meta file. I don't know why the GUI would be having problems but it may be because these 2 files do not have the correct ownership or permissions.

[493669]

added below stanza in default.meta :

 [collections]
export = system

and

[lookups]
 export = system 

this stanza already present.
checked local.meta but i did not find any sample entry .below stanza are present in local.meta

[app/ui]
version = 6.4.5
modtime = 1491051965.784553700

[app/launcher]
version = 6.4.5
modtime = 1491051965.929988500

still gives same error

[woodcock]

Did you hit the debug/refresh endpoint or restart splunk on the Search Head?

[493669]

After debug/refresh i get following errors:
1.

Refreshing admin/crl                       ResourceNotFound 
 In handler 'crl': Invalid action for this internal handler (handler: crl, supported: list|_reload, wanted: list).

2.

Refreshing admin/remote_indexes            BadRequest 
 In handler 'remote_indexes': The following required arguments are missing: repositoryLocation.

[woodcock]

Those 2 errors are normal; I always see them, even on a fresh install so that is not it. After the debug/refresh, are you still getting some search |outputlookup errors (forget about |inputlookup until we get outputlookup working)?

[493669]

After trying ...|outputlookup sample get same error as

"Error in 'outputlookup' command: The
lookup table 'sample' is invalid."

[woodcock]

You should DEFINITELY open a support case. Be sure to followup and let us all know what the conclusion/fix turns out to be.

[493669]

I am unable to open support case as it shows "It appears you do not have an active Support Contract or entitlement and as a result, cannot open a Support case."

[woodcock]

Pick an question and stick to it; do not keep opening the same question over and over.

[starcher]

If you provide your config stanzas it would be easier for someone to provide some guidance.

[493669]

in Local folder-
Collections.conf
[sample]
field.test = string
field.check = string
replicate = true

Transforms.conf
[sample_store]
external_type = kvstore
collection = sample
fields_list = test, check