Installation
Highlighted

retention period, license cost, storage location for KV store and other lookups

Communicator

I read KV store and other lookups dont incur license cost since they're stored on the Search heads. So whats the retention period of KV store lookups and other lookups?

Labels (2)
Tags (3)
0 Karma
Highlighted

Re: retention period, license cost, storage location for KV store and other lookups

Builder

Retention is until you delete them on your Splunk instance.

When it comes to License: If your License expires, all your Searches are disabled which might block you to view your lookups using UI. Work around is that you can view the lookup data from the splunk server ($SPLUNK_HOME/etc/apps/search/lookups). But you can't create new lookups in Splunk.

View solution in original post

Highlighted

Re: retention period, license cost, storage location for KV store and other lookups

Path Finder

This path will only have the csv lookups. $SPLUNK_HOME/etc/apps//lookups

The KV lookups can only be accessed from the UI or via REST API. And that would require a valid license.

0 Karma
Highlighted

Re: retention period, license cost, storage location for KV store and other lookups

Communicator

Thankyou @KARANMALHOTRA and @nareshinsvu

0 Karma