Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Admin Other
- :
- Knowledge Management
- :
- How do you add a field/column to an existing kvsto...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We have a kvstore that has been used for about a year.
Now we need to add a new field/column to the kvstore, but we can't find any info on how to do this or if it's even possible.
So my question is: is this possible? if so, how?
Or is the only option to create a completely new kvstore?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @snorri,
Add the new field name in transforms.conf and collections.conf under that kv store lookup stanza.
like in transforms.conf add under fields_list comma separated value.
and in collections.conf >> field.fieldname = string/number
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @snorri,
Add the new field name in transforms.conf and collections.conf under that kv store lookup stanza.
like in transforms.conf add under fields_list comma separated value.
and in collections.conf >> field.fieldname = string/number
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hm. I have already done this, also in the lookup definitions. Is it enough to _bump the splunk version or do I have to restart splunk for the changes to take effect?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
you need to restart splunk
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
OR run <splunkweb>/en-US/debug/refresh
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I added the field in: lookup defenition, collections.conf and transforms.conf.
After restarting the new field appeard. Thanks alot!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
if still not working can you show us your conf?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I added the field in: lookup defenition, collections.conf and transforms.conf.
After restarting the new field appeard. Thanks alot!
Index This | When is October more than just the tenth month?
Observe and Secure All Apps with Splunk
What’s New & Next in Splunk SOAR
