retention period, license cost, storage location for KV store and other lookups

[Harishma]

I read KV store and other lookups dont incur license cost since they're stored on the Search heads. So whats the retention period of KV store lookups and other lookups?

[nareshinsvu · Accepted solution]

Retention is until you delete them on your Splunk instance.

When it comes to License: If your License expires, all your Searches are disabled which might block you to view your lookups using UI. Work around is that you can view the lookup data from the splunk server ($SPLUNK_HOME/etc/apps/search/lookups). But you can't create new lookups in Splunk.

[KARANMALHOTRA]

This path will only have the csv lookups. $SPLUNK_HOME/etc/apps//lookups

The KV lookups can only be accessed from the UI or via REST API. And that would require a valid license.

[Harishma]

Thankyou @KARANMALHOTRA and @nareshinsvu