Hi,
I am trying to create kv store lookup by adding below stanza in transforms.conf and collections.conf.
Currently I am using Windows OS and splunk is 6.4.5 (Free version) standalone.
in transforms.conf-
[test_store]
external_type = kvstore
collection = test_collection
fields_list = Name, Country
and in collections.conf-
[test_collection]
field.Name = string
field.Country = string
after when i search |inputlookup test_store
it gives error as "The lookup table 'test_store' is invalid."
I had read few articles so did the following things.
1. Created server.conf in local
[kvstore]
disabled=false
2. Checked for mongod.log file I find the following lines-
98 Unable to create/open lock file: C:\Program Files\Splunk\var\lib\splunk\kvstore\mongo\mongod.lock errno:5 Access is denied.. Is a mongod instance already running?, terminating
2017-03-12T10:01:26.970Z I CONTROL [initandlisten] dbexit: rc: 100
Kindly advise.
do you have multiple mongod.exe in task manager?
do you have multiple splunk installs running?
Mongod gives this error when the port is already in use. Or if it exits improperly and the lock file is left behind. You can try manually removing the lock file after verifying splunk is stopped and mongod.exe isnt running otherwise...
C:\Program Files\Splunk\var\lib\splunk\kvstore\mongo\mongod.lock <- the lock file
@jkat54,
splunk single instance is running and i have not seen mongod.exe running in task manager. also i deleted mongod.lock but still i am not able to create kv store lookup.
i am able to create csv lookup but not kv store
also in lookup editor app i tried creating kv store lookup but still it gives error as "The KV store collection could not be created"
Kindly advise