Splunk Dev

Seeing the data in kvstore, created by "Add On Builder"

MartinTerp
New Member

Hi

I have created an app using the Add-on builder, by:

 

collectionName = "myKVStore"

service = connect(scheme=scheme, host=splunkd_host, port=splunkd_port, token=helper.session_key, owner="nobody")
     
if not collectionName in service.kvstore:
    service.kvstore.create(collectionName)

 

 

I would like to see the data in my kvstore, IN Splunk, i have tried to query the api with no luck, also tried to define it transforms.conf:

 

[myKVstore]
external_type = kvstore
case_sensitive_match = false
collection = myKVstore
fields_list =  _key, ....

 

 

If i then query it by: |inputlookup ... i get "collection does not exist"
But it works fine within my code

Ideas?

Labels (3)
0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Try to make sure that when you are running the | inputlookup search from the Add-on's search dashboard where the collection is defined.

Collection definition should be present in the collections.conf file

- You can search from the backend of your search with below CLI  to find out where the collection has defined. 

./splunk btool collections list myKVStore --debug

If you don't see any results that means the error is correct and you do not have collection defined and you need to create a collection first.

 

If you see the file listed then try to run the | inputlookup search from that App.

Alternatively, you can also look at default.meta or local.meta file to change the permission of the collection and lookup definition(transforms) - https://docs.splunk.com/Documentation/Splunk/8.2.4/Admin/Defaultmetaconf

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...