A newly created KVStore collection is not returning matches for a lookup command, despite the fact it's populated. For example:
| inputlookup my_kvstore
Returns the following results:
field_1 | field_2 | field_3 |
Abc | Def | Hij |
Therefore, I would expect to be able to lookup field_1 and get the same results.
| makeresults
| eval field_1 = "Abc"
| fields - _time
| lookup my_kvstore field_1
Instead, I get:
field_1 | field_2 | field_3 |
Abc |
To rule out any typos, I even tried:
| inputlookup my_kvstore
| table field_1
| lookup my_kvstore field1 OUTPUT field_1 AS new_field
But that returns:
field_1 | new_field |
Abc |
As for the configuration:
## collections.conf ##
[my_kvstore]
field.field_1= string
field.field_2= string
field.field_3 = string
replicate = true
disabled = 0
## transforms.conf ##
[my_kvstore]
collection = my_kvstore
external_type = kvstore
fields_list = field_1,field_2,field_3
case_sensitive_match = 0
I'm at a loss, but before I go down the support route, I'd appreciate any hel
The issue was actually the "case_sensitive_match" transforms.conf entry.
The case_sensitive_match entry requires the kvstore contents to be lower case. If you don't drop the case on your kvstore contents then the | lookup command will stop matching, even if the case matches! This is one for my notebook...
The issue was actually the "case_sensitive_match" transforms.conf entry.
The case_sensitive_match entry requires the kvstore contents to be lower case. If you don't drop the case on your kvstore contents then the | lookup command will stop matching, even if the case matches! This is one for my notebook...