Knowledge Management

Can KV_MODE be set in props.conf and transforms.conf?

Lowell
Super Champion

Does any one know if KV_MODE can be set in transforms.conf?

The docs don't say you can do this, but I've seen examples that do. For example, the stash_extract in 4.1.2 includes KV_MODE = none. So is this a configuration bug, or some hidden feature?

Tags (1)
0 Karma
1 Solution

Stephen_Sorkin
Splunk Employee
Splunk Employee

KV_MODE is only a valid option in props.conf. Its use in transforms.conf doesn't do anything.

View solution in original post

Stephen_Sorkin
Splunk Employee
Splunk Employee

KV_MODE is only a valid option in props.conf. Its use in transforms.conf doesn't do anything.

Lowell
Super Champion

Thanks Stephen. That's what I suspected. I submitted this as Case# 44525.

0 Karma

nawazns5038
Builder

Should it be used in the heavy forwarder or the search head ?

Does "KV_MODE" effect the search time extractions even though we keep it only in the heavy forwarder

0 Karma
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...