Hello, Is there a process to remove data from mongo DB when the KVStore's collections.conf and transforms.conf have been previously deleted? I am making an assumption that the clean command for k...
Creating Lookup Definition (transforms stanza) can be done on Splunk Web UI. But since we need to point a kv definition to a collections.conf, we must have that stanza in collections.conf. How do w...
Hi Guys
Where can we find KV Store - collections.conf in Splunk ITSI?
Our ITSI was on search head cluster & I don't see the storage/collections folder in SA-ITOA folder on search head?
Thanks
We have a kvstore that has been used for about a year.
Now we need to add a new field/column to the kvstore, but we can't find any info on how to do this or if it's even possible.
So my questio...
Currently I am using below query to run my search to get the common event in tc and email, |inputlookup tc | search type=emailaddress| rename indicator as SenderAddress |dedup SenderAddress | tabl...
I know ITSI is using KVstore to store details like ITSI team, Services, KPIs, templates, Glass Tables, etc.
Is there any list I can get which data ITSI stores in which lookup or KVstore collection...
Hi,
In Splunk 6.4.5 standalone on Windows. After creating an app, I added a stanza in transforms.conf and collections.conf in default folder. Then after adding few entries in that KV Store i am a...
I have created a collection in app/local/collections.conf
a matching lookup in app/local/transforms.conf
I have 5 key fields which together for the unique key, the combination of these is also s...