Splunk Search

KVStore Lookup Not Returning Results

Tom_Lundie
Contributor

A newly created KVStore collection is not returning matches for a lookup command, despite the fact it's populated. For example:

| inputlookup my_kvstore​​​​


Returns the following results:

 

field_1field_2field_3
AbcDefHij


Therefore, I would expect to be able to lookup field_1 and get the same results.

| makeresults
| eval field_1 = "Abc"
| fields - _time
| lookup my_kvstore field_1​​​​​


Instead, I get:

field_1field_2field_3
Abc  


To rule out any typos, I even tried:

| inputlookup my_kvstore
| table field_1
| lookup my_kvstore field1 OUTPUT field_1 AS new_field​​​​​


But that returns:

field_1new_field
Abc 


As for the configuration:

## collections.conf ##
[my_kvstore]
field.field_1= string
field.field_2= string
field.field_3 = string
replicate = true
disabled = 0

## transforms.conf ##
[my_kvstore]
collection = my_kvstore
external_type = kvstore
fields_list = field_1,field_2,field_3
case_sensitive_match = 0

I'm at a loss, but before I go down the support route, I'd appreciate any hel

 

 

Labels (1)
0 Karma
1 Solution

Tom_Lundie
Contributor

The issue was actually the "case_sensitive_match" transforms.conf entry.

The case_sensitive_match entry requires the kvstore contents to be lower case. If you don't drop the case on your kvstore contents then the | lookup command will stop matching, even if the case matches! This is one for my notebook...

View solution in original post

0 Karma

Tom_Lundie
Contributor

The issue was actually the "case_sensitive_match" transforms.conf entry.

The case_sensitive_match entry requires the kvstore contents to be lower case. If you don't drop the case on your kvstore contents then the | lookup command will stop matching, even if the case matches! This is one for my notebook...

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...