Knowledge Management
Highlighted

How do you add a field/column to an existing kvstore?

Path Finder

We have a kvstore that has been used for about a year.

Now we need to add a new field/column to the kvstore, but we can't find any info on how to do this or if it's even possible.

So my question is: is this possible? if so, how?

Or is the only option to create a completely new kvstore?

0 Karma
Highlighted

Re: How do you add a field/column to an existing kvstore?

Super Champion

Hi @snorri,

Add the new field name in transforms.conf and collections.conf under that kv store lookup stanza.
like in transforms.conf add under fields_list comma separated value.
and in collections.conf >> field.fieldname = string/number

View solution in original post

Highlighted

Re: How do you add a field/column to an existing kvstore?

Path Finder

hm. I have already done this, also in the lookup definitions. Is it enough to _bump the splunk version or do I have to restart splunk for the changes to take effect?

0 Karma
Highlighted

Re: How do you add a field/column to an existing kvstore?

Super Champion

you need to restart splunk

Highlighted

Re: How do you add a field/column to an existing kvstore?

Contributor

if still not working can you show us your conf?

0 Karma
Highlighted

Re: How do you add a field/column to an existing kvstore?

Path Finder

I added the field in: lookup defenition, collections.conf and transforms.conf.
After restarting the new field appeard. Thanks alot!

0 Karma
Highlighted

Re: How do you add a field/column to an existing kvstore?

Path Finder

I added the field in: lookup defenition, collections.conf and transforms.conf.
After restarting the new field appeard. Thanks alot!

0 Karma