How to transfer existing CSV data to kvstore?

[sandeep_thosar]

Hi Team,

I have just installed splunk 6.2 version and need to transfer my existing .csv lookup files to KV store. I have tried lot of things from the net but no luck. Can anybody help me with a solution or useful link where I can get some sample examples?

Thanks in advance.

Sandeep Thosar

[Muryoutaisuu]

Hi. this worked for me:

collections.conf

[<collectionname>]

transforms.conf

[<collectionname>_lookup]
external_type = kvstore
collection = <collectionname>
fields_list = _key, <comma separated list of fields>

And then use a command like that:

| inputlookup <yourfile>.csv | outputlookup <collectionname>_lookup

---

Edit: Example:

collection.conf

[mycoll]

transforms.conf

[mycoll_lookup]
external_type = kvstore
collection = mycoll
fields_list = _key, field1, field2

data.csv

field1,field2
value11,value12
value21,value22
value31,value32

And the command:

| inputlookup data.csv | outputlookup mycoll_lookup

[gfuente]

Here is exactly what you are looking for:

http://dev.splunk.com/view/SP-CAAAEZQ

Good Luck

[sandeep_thosar]

Hi,

Thanks for the prompt reply. I have already tried link which you mentioned but i have received following error.

Error in 'outputlookup' command: The lookup table 'test' is invalid.

[Muryoutaisuu]

Looks to me as if you forgot the transforms.conf stanza

[sandeep_thosar]

Hi Muryoutaisuu

Thanks for the reply. I have one query where we store collections.conf and transforms.conf file, means on local directory or on somewhere inside Splunk home directory.

Thanks in advance.

Regards,

Sandeep

[gfuente]

Please, post the search you are using...

[sandeep_thosar]

Hi,

In my scenario i have created one Lookup file (.csv) which contains AccountNo's and from this Lookup file need to insert records into the kvstore_Lookup. Folowing is my search Query.

| inputlookup lkpAttemptByAccount.csv | outputlookup mycollections_lookup

Thanks in Advance.

Regards,

Sandeep