Splunk Search

KVStore Lookup Not Returning Results

Tom_Lundie
Contributor

A newly created KVStore collection is not returning matches for a lookup command, despite the fact it's populated. For example:

| inputlookup my_kvstore​​​​


Returns the following results:

 

field_1field_2field_3
AbcDefHij


Therefore, I would expect to be able to lookup field_1 and get the same results.

| makeresults
| eval field_1 = "Abc"
| fields - _time
| lookup my_kvstore field_1​​​​​


Instead, I get:

field_1field_2field_3
Abc  


To rule out any typos, I even tried:

| inputlookup my_kvstore
| table field_1
| lookup my_kvstore field1 OUTPUT field_1 AS new_field​​​​​


But that returns:

field_1new_field
Abc 


As for the configuration:

## collections.conf ##
[my_kvstore]
field.field_1= string
field.field_2= string
field.field_3 = string
replicate = true
disabled = 0

## transforms.conf ##
[my_kvstore]
collection = my_kvstore
external_type = kvstore
fields_list = field_1,field_2,field_3
case_sensitive_match = 0

I'm at a loss, but before I go down the support route, I'd appreciate any hel

 

 

Labels (1)
0 Karma
1 Solution

Tom_Lundie
Contributor

The issue was actually the "case_sensitive_match" transforms.conf entry.

The case_sensitive_match entry requires the kvstore contents to be lower case. If you don't drop the case on your kvstore contents then the | lookup command will stop matching, even if the case matches! This is one for my notebook...

View solution in original post

0 Karma

Tom_Lundie
Contributor

The issue was actually the "case_sensitive_match" transforms.conf entry.

The case_sensitive_match entry requires the kvstore contents to be lower case. If you don't drop the case on your kvstore contents then the | lookup command will stop matching, even if the case matches! This is one for my notebook...

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...