Splunk Search

KVStore Lookup Not Returning Results

Tom_Lundie
Contributor

A newly created KVStore collection is not returning matches for a lookup command, despite the fact it's populated. For example:

| inputlookup my_kvstore​​​​


Returns the following results:

 

field_1field_2field_3
AbcDefHij


Therefore, I would expect to be able to lookup field_1 and get the same results.

| makeresults
| eval field_1 = "Abc"
| fields - _time
| lookup my_kvstore field_1​​​​​


Instead, I get:

field_1field_2field_3
Abc  


To rule out any typos, I even tried:

| inputlookup my_kvstore
| table field_1
| lookup my_kvstore field1 OUTPUT field_1 AS new_field​​​​​


But that returns:

field_1new_field
Abc 


As for the configuration:

## collections.conf ##
[my_kvstore]
field.field_1= string
field.field_2= string
field.field_3 = string
replicate = true
disabled = 0

## transforms.conf ##
[my_kvstore]
collection = my_kvstore
external_type = kvstore
fields_list = field_1,field_2,field_3
case_sensitive_match = 0

I'm at a loss, but before I go down the support route, I'd appreciate any hel

 

 

Labels (1)
0 Karma
1 Solution

Tom_Lundie
Contributor

The issue was actually the "case_sensitive_match" transforms.conf entry.

The case_sensitive_match entry requires the kvstore contents to be lower case. If you don't drop the case on your kvstore contents then the | lookup command will stop matching, even if the case matches! This is one for my notebook...

View solution in original post

0 Karma

Tom_Lundie
Contributor

The issue was actually the "case_sensitive_match" transforms.conf entry.

The case_sensitive_match entry requires the kvstore contents to be lower case. If you don't drop the case on your kvstore contents then the | lookup command will stop matching, even if the case matches! This is one for my notebook...

0 Karma
Get Updates on the Splunk Community!

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...