Knowledge Management

When I try to perform outputlookup on the kvstore, I get the following error:

sidtalup27
Explorer

Hello,

I have created a KVstore lookup, when I try to perform outputlookup on the kvstore, I get the following error.

Error in 'outputlookup' command: Could not write to collection 'test1': An error occurred while saving to the KV Store

When I refer to the log file, it gives the following information,

02-16-2023 16:56:51.841 ERROR KVStoreLookup [79866 phase_1] - KV Store output failed with err: The provided query was invalid. (Document may not contain '$' or '.' in keys.) message:
02-16-2023 16:56:51.841 ERROR SearchResultsFiles [79866 phase_1] - An error occurred while saving to the KV Store. Look at search.log for more information.
02-16-2023 16:56:51.905 ERROR outputcsv [79866 phase_1] - An error occurred during outputlookup, managed to write 0 rows
02-16-2023 16:56:51.905 ERROR outputcsv [79866 phase_1] - Error in 'outputlookup' command: Could not write to collection 'test1': An error occurred while saving to the KV Store. Look at search.log for more information..

Can you please advise on this.
Thanks in advance.

Siddarth

0 Karma

sidtalup27
Explorer

@PickleRick , there is no such data.

Below is the data and respective fields that will be written to the lookup.

sidtalup27_0-1676897147461.png

Below the definition of the KVstore.

sidtalup27_1-1676897254376.png

@PaulPanther , yes, the KV store does exist.

 

--
Thanks,
Siddarth

 

 

0 Karma

PaulPanther
Motivator

@sidtalup27 The table contains the field key without underscore but your lookup definition only contains the internal key field _key. I assume that your collection looks similiar. If yes please define the field in your collections.conf and in your transforms.conf.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Your error says:

"Document may not contain '$' or '.' in keys."

Do any of the result fields that you want to save into the kvstore contain $ or . in the field name?

0 Karma

PaulPanther
Motivator

@sidtalup27 The KV store collection "test1" already exists?  How looks the output of your search query?

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...