Good day
Is it possible to configure MS AD objects to use kvstore for the lookup file instead of CSV ? We have a very large AD environment and lookups take up more space and time to sync with t...
Can any one help? I am trying to configure a KVStorelookup, I have followed the online documentation: https://docs.splunk.com/Documentation/Splunk/8.1.3/Knowledge/Configure...
...removed all existing file-based lookups.
changed searches in savedsearch.conf to populate KVStore instead of a traditional lookup.
I am able to configure & use KVStore without any issue....
KVstorelookups are failing with the following error:
Error in 'inputlookup' command: External command based lookup 'kvstore_lookup' is not available because KVStore initialization has failed....
...etter for performances : doing a query directly from the KVstore or doing a scheduled search from the KVStore in order to generate a lookup? [| inputlookup ind.csv ] `diskspace` Thanks
Since i upgrdaed splunk enterprise to 5.5.3 and installed Enterprise security app, i am getting following error continuously in splunkd.log.
Failed to execute KVStorelookups: External command b...
I read KVstore and other lookups dont incur license cost since they're stored on the Search heads. So whats the retention period of KVstorelookups and other lookups?
...umber
field.earliest_time = time
field.latest_time = time
field.schedule_time = time
field.sla_id = string
replicate = true
When I look at the KVstore in the lookup e...
I've been reading over the 6.2 documentation for the KVstore and I'm not entirely clear on what the benefits are compared to a traditional lookup table.
Can somebody give some examples where a KV...
Have time-based lookups working well with CSV file. When I try to get it working with KVStore, I CANNOT get it to work. Have been trying various solutions for many many hours.
Works (s_uname a...