How come when I run inputlookup myLookupTest, it's returning 0 results?

[bbritten]

I created a test KVStore in order to familiarize myself with the API. It has about 20 records in it, all of which are listed under the user nobody (viewable from search). However, when running |inputlookup myLookupTest, I get 0 results despite being in the same app in which the KVStore is visible.

Any idea why that might be the case?

[Vijeta · Accepted solution]

Did you define the KV store using lookup editor, what is your KV store name and did you create a lookup from Settings->lookups->Lookup->lookup definitions and create with Type as KV store and give lookup file name as your KV store name.

[bbritten]

• Did you define the KV store using lookup editor? yes
• What is your KV store name? This is different from the collection name, right? I'm not sure of the store name (I'm brand new to Splunk). The collection name is bbrittenKVTest
• Did you create a lookup from Settings -> Lookup -> Lookup Definitions? no
• Did you create it with type as KV and give the lookup file name as your KV store name? no

It sounds like this is what I need to do.

[Vijeta]

Collection name is what I was referring to as KV store name, that is what you need to put when you define your lookup.

[bbritten]

You're amazing! All I had to do was add the definition in Settings -> Lookup -> Lookup Definition and I was able to query the lookup table.

You've already solved my problem, but would you mind providing a little more detail for my own edification? Why does a definition need to be provided? Why wasn't Splunk able to just return the results without it?

Thank you again for your help!

[p_gurav]

Can you tell what permission you set for kvstore collection?

[bbritten]

@p_gurav The permissions are {"read": "everyone", "write": "soc_elevated"}

[niketn]

@bbritten did you check Search Job Inspector and also search.log? Any additional information there?
For testing can you create few rows and test outputlookup command if that works?

[bbritten]

Looking in the Search Job Inspector, I see that it gives the following message: warn: myLookupTest is invalid If go to the Settings drop-down menu item and select Lookups, I'm also unable to find it in the Lookup Files or Lookup Definitions. The only place I can find it is if I go to the Lookup Editor app and search for it there. Did I perhaps create the lookup in the wrong place?