I am trying to migrate from CSV to KV store following these steps: Created collection.conf on the host in apps local directory as following: [KV_collection] enforceTypes = true field.fieldname = string field.fieldname = number field.fieldname = number field.fieldname = string ... Created transform.conf on the host in apps local directory as following: [KV_lookup] external_type = kvstore collection = KV_collection fields_list = fieldname1, fieldname2... Used following command to migrate from exciting CSV to KV store | inputlookup lookup_tabl.csv | outputlookup KV_lookup But getting error: Error in 'outputlookup' command: The lookup table 'Permission denied for collection 'KV_collection'' is invalid Can anyone help me where is the problem exactly? Do I need any special permission to access the collection? Also where can I find these collections that are created ? ... View more

Here's a quick question I am trying to implement calculated fields in props.conf using EVAL command following is the code that I am trying to implement: EVAL-PAYXLINE_MV2=mvindex(PAYXLINE_MV,N,-1) EVAL-PAYXLINEGLOB=mvjoin(PAYXLINE_MV2," ") EVAL-PAYXHASH=sha256(mvjoin(PAYXLINE_MV," ")) The problem is I am not able to get the first 2 commands working when I put mvindex and mvjoin directly but it works perfectly fine when I use mvjoin with sha256. Can you help me to solve this problem. Here is the documentation that I am following to define fields in props.conf. http://docs.splunk.com/Documentation/Splunk/6.2.1/Knowledge/definecalcfields ... View more