Splunk Dev

Seeing the data in kvstore, created by "Add On Builder"

MartinTerp
New Member

Hi

I have created an app using the Add-on builder, by:

 

collectionName = "myKVStore"

service = connect(scheme=scheme, host=splunkd_host, port=splunkd_port, token=helper.session_key, owner="nobody")
     
if not collectionName in service.kvstore:
    service.kvstore.create(collectionName)

 

 

I would like to see the data in my kvstore, IN Splunk, i have tried to query the api with no luck, also tried to define it transforms.conf:

 

[myKVstore]
external_type = kvstore
case_sensitive_match = false
collection = myKVstore
fields_list =  _key, ....

 

 

If i then query it by: |inputlookup ... i get "collection does not exist"
But it works fine within my code

Ideas?

Labels (3)
0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Try to make sure that when you are running the | inputlookup search from the Add-on's search dashboard where the collection is defined.

Collection definition should be present in the collections.conf file

- You can search from the backend of your search with below CLI  to find out where the collection has defined. 

./splunk btool collections list myKVStore --debug

If you don't see any results that means the error is correct and you do not have collection defined and you need to create a collection first.

 

If you see the file listed then try to run the | inputlookup search from that App.

Alternatively, you can also look at default.meta or local.meta file to change the permission of the collection and lookup definition(transforms) - https://docs.splunk.com/Documentation/Splunk/8.2.4/Admin/Defaultmetaconf

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Data Persistence in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. What happens if the OpenTelemetry collector ...

Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever

Now On Demand Whether you're managing complex deployments or looking to future-proof your data ...

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...