Knowledge Management

Kv store lookup table is invalid

493669
Super Champion

Hi,
I am trying to create kv store lookup by adding below stanza in transforms.conf and collections.conf.
Currently I am using Windows OS and splunk is 6.4.5 (Free version) standalone.
in transforms.conf-
[test_store]
external_type = kvstore
collection = test_collection
fields_list = Name, Country

and in collections.conf-
[test_collection]
field.Name = string
field.Country = string

after when i search |inputlookup test_store
it gives error as "The lookup table 'test_store' is invalid."

I had read few articles so did the following things.
1. Created server.conf in local
[kvstore]
disabled=false
2. Checked for mongod.log file I find the following lines-
98 Unable to create/open lock file: C:\Program Files\Splunk\var\lib\splunk\kvstore\mongo\mongod.lock errno:5 Access is denied.. Is a mongod instance already running?, terminating
2017-03-12T10:01:26.970Z I CONTROL [initandlisten] dbexit: rc: 100

Kindly advise.

0 Karma

jkat54
SplunkTrust
SplunkTrust

do you have multiple mongod.exe in task manager?

do you have multiple splunk installs running?

Mongod gives this error when the port is already in use. Or if it exits improperly and the lock file is left behind. You can try manually removing the lock file after verifying splunk is stopped and mongod.exe isnt running otherwise...

C:\Program Files\Splunk\var\lib\splunk\kvstore\mongo\mongod.lock <- the lock file

0 Karma

493669
Super Champion

@jkat54,
splunk single instance is running and i have not seen mongod.exe running in task manager. also i deleted mongod.lock but still i am not able to create kv store lookup.
i am able to create csv lookup but not kv store
also in lookup editor app i tried creating kv store lookup but still it gives error as "The KV store collection could not be created"

Kindly advise

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...