First attempt at creating a kvstore lookup to be used by the Search app - initially, at least; I've followed the documentation and defined,
[CollectionStanzaName_KVStoreName] external_type = kvstore collection = CollectionStanzaName fields_list = _key, Field1, Field2, Field3, ..., FieldN
Search heads restarted, and subsequent attempts to populate the kvstore using:
<moderately complicated search utilizing search-time transforms> | outputlookup append=t key_field=Unique_Field_Returned_By_Search CollectionStanzaName_KVStoreName
results in error:
Error in 'outputlookup' command: Option 'key_field=Unique_Field_Returned_By_Search' is invalid
If I try to simplify things and run,
<moderately complicated search utilising search-time transforms> | outputlookup CollectionStanzaName_KVStoreName
Error in 'outputlookup' command: The lookup table 'CollectionStanzaName_KVStoreName' is invalid.
and searching for these errors draws a blank, so I'm not sure what else to try.
Which Splunk version are you using?
Splunk 6.1 - running a search head pool we haven't quite got around to converting into a cluster, so no upgrade to 6.2 yet.
Ok, KVStore lookups available only starting from version 6.2
Well, that'll teach us not to upgrade... sorry for wasting your time with such an easy problem...