KV store lookup as array

[arunssd]

Hi 

I have a kv store lookup which populated automatically and it contains arrays . How can make it like a normal lookup that is searchable  or how to make it as a proper file 

current csv:

I want the above kv store as a searchable lookup with proper segregation between each rows 

[tscroggins]

Hi @arunssd,

If 1) your KV store collection uses array fields, 2) all field values have a 1:1:1:1 relationship, and 3) there are no empty/missing/null values within a field, i.e. all array values "line up":

asn                country    maliciousbehavior    riskscore
103.152.101.251 => PK      => 3                 => 9
103.96.75.159   => HK      => 3                 => 11
104.234.115.155 => CA      => 4                 => 9

you can transform the data with the transpose, mvexpand, and chart commands:

| inputlookup arunssd_kv
| transpose 0
| mvexpand "row 1"
| chart values("row 1") over _mkv_child by column
| fields - _mkv_child
| outputlookup arunssd_lookup.csv

However, your results may be truncated by mvexpand if the total size of the in-memory result is greater than the limits.conf max_mem_usage_mb setting (default: 500 MB). See https://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf#.5Bmvexpand.5D.

If this doesn't work for you, please share your collections.conf (KV store) and transforms.conf (lookup) settings. I used the following settings to test:

# collections.conf

[arunssd_kv]
field.asn = array
field.country = array
field.maliciousbehavior = array
field.riskscore = array

# transforms.conf

[arunssd_kv]
collection = arunssd_kv
external_type = kvstore
fields_list = asn,country,maliciousbehavior,riskscore

If your KV store fields are strings, the search can be adapted with the foreach and eval commands to coerce the fields values into a multi-valued type.

You can also transform the results from a shell using curl and jq or your scripting tools of choice.