Knowledge Management

Kv store lookup table is invalid

493669
Super Champion

Hi,
I am trying to create kv store lookup by adding below stanza in transforms.conf and collections.conf.
Currently I am using Windows OS and splunk is 6.4.5 (Free version) standalone.
in transforms.conf-
[test_store]
external_type = kvstore
collection = test_collection
fields_list = Name, Country

and in collections.conf-
[test_collection]
field.Name = string
field.Country = string

after when i search |inputlookup test_store
it gives error as "The lookup table 'test_store' is invalid."

I had read few articles so did the following things.
1. Created server.conf in local
[kvstore]
disabled=false
2. Checked for mongod.log file I find the following lines-
98 Unable to create/open lock file: C:\Program Files\Splunk\var\lib\splunk\kvstore\mongo\mongod.lock errno:5 Access is denied.. Is a mongod instance already running?, terminating
2017-03-12T10:01:26.970Z I CONTROL [initandlisten] dbexit: rc: 100

Kindly advise.

0 Karma

jkat54
SplunkTrust
SplunkTrust

do you have multiple mongod.exe in task manager?

do you have multiple splunk installs running?

Mongod gives this error when the port is already in use. Or if it exits improperly and the lock file is left behind. You can try manually removing the lock file after verifying splunk is stopped and mongod.exe isnt running otherwise...

C:\Program Files\Splunk\var\lib\splunk\kvstore\mongo\mongod.lock <- the lock file

0 Karma

493669
Super Champion

@jkat54,
splunk single instance is running and i have not seen mongod.exe running in task manager. also i deleted mongod.lock but still i am not able to create kv store lookup.
i am able to create csv lookup but not kv store
also in lookup editor app i tried creating kv store lookup but still it gives error as "The KV store collection could not be created"

Kindly advise

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...