Splunk Search

KVStore Field returning Invalid result- How do I fix this?

rjscholl
New Member

Hello.

I have some KVStore collections in our cloud environment.  In some of those collections, there are boolean fields that I want to use with search logic.  Examples are called "curbside.disabled" and "curbside.offered".  I want to be able to say if curbside.offered is true, add 1 to a totalOffered field so I can get a count of all offered items offered and all items disabled.  Then I can do some math on those.  Each time I try to use one of those fields, the search failed.  When I assign a temp field to typeof(curbside.disabled), etc. it returns "invalid".  The kvstores were created in Lookup Editor and lookup definitions are created.  I can see the fields and table them.  I can't use the data in them.  What am I doing wrong?

Labels (1)
0 Karma

rjscholl
New Member

I have it working by putting $ before and after the field name.

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...