Splunk Search

KVStore Lookup Not Returning Results

Tom_Lundie
Contributor

A newly created KVStore collection is not returning matches for a lookup command, despite the fact it's populated. For example:

| inputlookup my_kvstore​​​​


Returns the following results:

 

field_1field_2field_3
AbcDefHij


Therefore, I would expect to be able to lookup field_1 and get the same results.

| makeresults
| eval field_1 = "Abc"
| fields - _time
| lookup my_kvstore field_1​​​​​


Instead, I get:

field_1field_2field_3
Abc  


To rule out any typos, I even tried:

| inputlookup my_kvstore
| table field_1
| lookup my_kvstore field1 OUTPUT field_1 AS new_field​​​​​


But that returns:

field_1new_field
Abc 


As for the configuration:

## collections.conf ##
[my_kvstore]
field.field_1= string
field.field_2= string
field.field_3 = string
replicate = true
disabled = 0

## transforms.conf ##
[my_kvstore]
collection = my_kvstore
external_type = kvstore
fields_list = field_1,field_2,field_3
case_sensitive_match = 0

I'm at a loss, but before I go down the support route, I'd appreciate any hel

 

 

Labels (1)
0 Karma
1 Solution

Tom_Lundie
Contributor

The issue was actually the "case_sensitive_match" transforms.conf entry.

The case_sensitive_match entry requires the kvstore contents to be lower case. If you don't drop the case on your kvstore contents then the | lookup command will stop matching, even if the case matches! This is one for my notebook...

View solution in original post

0 Karma

Tom_Lundie
Contributor

The issue was actually the "case_sensitive_match" transforms.conf entry.

The case_sensitive_match entry requires the kvstore contents to be lower case. If you don't drop the case on your kvstore contents then the | lookup command will stop matching, even if the case matches! This is one for my notebook...

0 Karma
Get Updates on the Splunk Community!

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...