Installation

retention period, license cost, storage location for KV store and other lookups

Harishma
Communicator

I read KV store and other lookups dont incur license cost since they're stored on the Search heads. So whats the retention period of KV store lookups and other lookups?

Labels (2)
Tags (3)
0 Karma
1 Solution

nareshinsvu
Builder

Retention is until you delete them on your Splunk instance.

When it comes to License: If your License expires, all your Searches are disabled which might block you to view your lookups using UI. Work around is that you can view the lookup data from the splunk server ($SPLUNK_HOME/etc/apps/search/lookups). But you can't create new lookups in Splunk.

View solution in original post

nareshinsvu
Builder

Retention is until you delete them on your Splunk instance.

When it comes to License: If your License expires, all your Searches are disabled which might block you to view your lookups using UI. Work around is that you can view the lookup data from the splunk server ($SPLUNK_HOME/etc/apps/search/lookups). But you can't create new lookups in Splunk.

View solution in original post

KARANMALHOTRA
Path Finder

This path will only have the csv lookups. $SPLUNK_HOME/etc/apps//lookups

The KV lookups can only be accessed from the UI or via REST API. And that would require a valid license.

0 Karma

Harishma
Communicator

Thankyou @KARANMALHOTRA and @nareshinsvu

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!