Splunk Search

KVStore Lookup Not Returning Results

Tom_Lundie
Contributor

A newly created KVStore collection is not returning matches for a lookup command, despite the fact it's populated. For example:

| inputlookup my_kvstore​​​​


Returns the following results:

 

field_1field_2field_3
AbcDefHij


Therefore, I would expect to be able to lookup field_1 and get the same results.

| makeresults
| eval field_1 = "Abc"
| fields - _time
| lookup my_kvstore field_1​​​​​


Instead, I get:

field_1field_2field_3
Abc  


To rule out any typos, I even tried:

| inputlookup my_kvstore
| table field_1
| lookup my_kvstore field1 OUTPUT field_1 AS new_field​​​​​


But that returns:

field_1new_field
Abc 


As for the configuration:

## collections.conf ##
[my_kvstore]
field.field_1= string
field.field_2= string
field.field_3 = string
replicate = true
disabled = 0

## transforms.conf ##
[my_kvstore]
collection = my_kvstore
external_type = kvstore
fields_list = field_1,field_2,field_3
case_sensitive_match = 0

I'm at a loss, but before I go down the support route, I'd appreciate any hel

 

 

Labels (1)
0 Karma
1 Solution

Tom_Lundie
Contributor

The issue was actually the "case_sensitive_match" transforms.conf entry.

The case_sensitive_match entry requires the kvstore contents to be lower case. If you don't drop the case on your kvstore contents then the | lookup command will stop matching, even if the case matches! This is one for my notebook...

View solution in original post

0 Karma

Tom_Lundie
Contributor

The issue was actually the "case_sensitive_match" transforms.conf entry.

The case_sensitive_match entry requires the kvstore contents to be lower case. If you don't drop the case on your kvstore contents then the | lookup command will stop matching, even if the case matches! This is one for my notebook...

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...