Splunk Search

How to migrate from CSV to KV store?

tsawant
New Member

I am trying to migrate from CSV to KV store following these steps:

  1. Created collection.conf on the host in apps local directory as following:

[KV_collection]
enforceTypes = true
field.fieldname = string
field.fieldname = number
field.fieldname = number
field.fieldname = string
...

  1. Created transform.conf on the host in apps local directory as following:

[KV_lookup]
external_type = kvstore
collection = KV_collection
fields_list = fieldname1, fieldname2...

  1. Used following command to migrate from exciting CSV to KV store

| inputlookup lookup_tabl.csv | outputlookup KV_lookup

But getting error:
Error in 'outputlookup' command: The lookup table 'Permission denied for collection 'KV_collection'' is invalid

Can anyone help me where is the problem exactly?
Do I need any special permission to access the collection?
Also where can I find these collections that are created ?

Labels (1)
0 Karma

Atchyuth_P
Path Finder

Hi @tsawant 

Please try to check the lookup definition permission whether it is in private or app.

 

Hoping this will resolve the issue

0 Karma

duartet
Path Finder

The file name should be collections.conf instead of collection.conf

0 Karma

spyme72
Path Finder

The KVStore could be present inside an app and you may be running the search from search app.
The search is not able to reach the kvstore. try running the search from the app where the kvstore is created.

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...