Getting Data In
Highlighted

After editing the KV Store for my custom app, why do I receive error "The lookup table is invalid" when using the inputlookup command?

Super Champion

Hi,
In Splunk 6.4.5 standalone on Windows. After creating an app, I added a stanza in transforms.conf and collections.conf in default folder. Then after adding few entries in that KV Store i am able to see through |inputlookup command
Then i added transforms.conf and collections.conf in the local folder of the app and then added stanza for KV Store, but when i tried |inputlookup command it gives me error as "The lookup table is invalid".
Please advise.

Highlighted

Re: After editing the KV Store for my custom app, why do I receive error "The lookup table is invalid" when using the inputlookup command?

SplunkTrust
SplunkTrust

If you provide your config stanzas it would be easier for someone to provide some guidance.

0 Karma
Highlighted

Re: After editing the KV Store for my custom app, why do I receive error "The lookup table is invalid" when using the inputlookup command?

Super Champion

in Local folder-
Collections.conf
[sample]
field.test = string
field.check = string
replicate = true

Transforms.conf
[samplestore]
external
type = kvstore
collection = sample
fields_list = test, check

0 Karma
Highlighted

Re: After editing the KV Store for my custom app, why do I receive error "The lookup table is invalid" when using the inputlookup command?

Esteemed Legend

Pick an question and stick to it; do not keep opening the same question over and over.

0 Karma
Highlighted

Re: After editing the KV Store for my custom app, why do I receive error "The lookup table is invalid" when using the inputlookup command?

Esteemed Legend

You should DEFINITELY open a support case. Be sure to followup and let us all know what the conclusion/fix turns out to be.

0 Karma
Highlighted

Re: After editing the KV Store for my custom app, why do I receive error "The lookup table is invalid" when using the inputlookup command?

Super Champion

I am unable to open support case as it shows "It appears you do not have an active Support Contract or entitlement and as a result, cannot open a Support case."

0 Karma
Highlighted

Re: After editing the KV Store for my custom app, why do I receive error "The lookup table is invalid" when using the inputlookup command?

Esteemed Legend

If you go to transforms.conf and change this:

[sample_store]

to this:

[sample]

then it will work (or at least it did for me). You could make the opposite change in collections.conf; the point is that when you make both stanza headers match, then it works. I could not find any documentation stating that the names must match, and, as we both discovered, Splunk does not complain upon instantiation if they do not, but it does complain when you try to read/write to the lookup.

0 Karma
Highlighted

Re: After editing the KV Store for my custom app, why do I receive error "The lookup table is invalid" when using the inputlookup command?

Super Champion

after making same header stanza for both transforms.conf and collection.conf still gives me error as "The lookup table 'sample' is invalid".
when i tried to create kv store through lookup definition it is get created but unable to set permission from private to global. it gives error as "Splunk could not update permissions for resource data/transforms/lookups [HTTP 500] Splunkd internal error; [{'type': 'ERROR', 'code': None, 'text': "\n In handler 'transforms-lookup': Data could not be written: /nobody/Test/transforms/ui/fields_list: ui, collectionName, app"}"

0 Karma
Highlighted

Re: After editing the KV Store for my custom app, why do I receive error "The lookup table is invalid" when using the inputlookup command?

Esteemed Legend

From the CLI, inside the app where the collection exists, create default.meta file in the metadata directory with this:

[collections]
export = system
[lookups]
export = system

Then manually remove any entries that you have for sample from your local.meta file. I don't know why the GUI would be having problems but it may be because these 2 files do not have the correct ownership or permissions.

0 Karma
Highlighted

Re: After editing the KV Store for my custom app, why do I receive error "The lookup table is invalid" when using the inputlookup command?

Super Champion

added below stanza in default.meta :

 [collections]
export = system

and

[lookups]
 export = system 

this stanza already present.
checked local.meta but i did not find any sample entry .below stanza are present in local.meta

[app/ui]
version = 6.4.5
modtime = 1491051965.784553700

[app/launcher]
version = 6.4.5
modtime = 1491051965.929988500

still gives same error

0 Karma