Knowledge Management

Can KV_MODE be set in props.conf and transforms.conf?

Lowell
Super Champion

Does any one know if KV_MODE can be set in transforms.conf?

The docs don't say you can do this, but I've seen examples that do. For example, the stash_extract in 4.1.2 includes KV_MODE = none. So is this a configuration bug, or some hidden feature?

Tags (1)
0 Karma
1 Solution

Stephen_Sorkin
Splunk Employee
Splunk Employee

KV_MODE is only a valid option in props.conf. Its use in transforms.conf doesn't do anything.

View solution in original post

Stephen_Sorkin
Splunk Employee
Splunk Employee

KV_MODE is only a valid option in props.conf. Its use in transforms.conf doesn't do anything.

View solution in original post

Lowell
Super Champion

Thanks Stephen. That's what I suspected. I submitted this as Case# 44525.

0 Karma

nawazns5038
Builder

Should it be used in the heavy forwarder or the search head ?

Does "KV_MODE" effect the search time extractions even though we keep it only in the heavy forwarder

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!