Hi Team,
I have just installed splunk 6.2 version and need to transfer my existing .csv lookup files to KV store. I have tried lot of things from the net but no luck. Can anybody help me with a solution or useful link where I can get some sample examples?
Thanks in advance.
Sandeep Thosar
Hi. this worked for me:
collections.conf
[<collectionname>]
transforms.conf
[<collectionname>_lookup]
external_type = kvstore
collection = <collectionname>
fields_list = _key, <comma separated list of fields>
And then use a command like that:
| inputlookup <yourfile>.csv | outputlookup <collectionname>_lookup
Edit: Example:
collection.conf
[mycoll]
transforms.conf
[mycoll_lookup]
external_type = kvstore
collection = mycoll
fields_list = _key, field1, field2
data.csv
field1,field2
value11,value12
value21,value22
value31,value32
And the command:
| inputlookup data.csv | outputlookup mycoll_lookup
Hi,
Thanks for the prompt reply. I have already tried link which you mentioned but i have received following error.
Error in 'outputlookup' command: The lookup table 'test' is invalid.
Looks to me as if you forgot the transforms.conf stanza
Hi Muryoutaisuu
Thanks for the reply. I have one query where we store collections.conf and transforms.conf file, means on local directory or on somewhere inside Splunk home directory.
Thanks in advance.
Regards,
Sandeep
Please, post the search you are using...
Hi,
In my scenario i have created one Lookup file (.csv) which contains AccountNo's and from this Lookup file need to insert records into the kvstore_Lookup. Folowing is my search Query.
| inputlookup lkpAttemptByAccount.csv | outputlookup mycollections_lookup
Thanks in Advance.
Regards,
Sandeep