Moving KVstore lookup using "Lookup definitions" does not work

[99eaglez]

After moving a KVstore to a new Application, Splunk can not longer render the lookup.

When moving a KVstore using the "move" link in "Lookup definitions" it only moves the transforms.conf stanza and not the collections.conf stanza.

The on-prem solution is to manually move collections.conf but this cannot be done in Splunk Cloud.

[99eaglez · Accepted solution]

Although it looks like you should be able to use the "move" link in "Lookup definitions", you cannot.

The best way to achieve this is to create a new KVstore in the desired location then copy the KVstore data there.

| inputlookup my_old_kvstore
| outputlookup my_new_kvstore

I did create a Splunk Idea to resolve this issue. Please vote for it here.