I have created a kvstore collection as below in collections.conf
replicate = true
Then I created a lookup based on the above kvstore collection in transforms.conf
collection = samplecollection
external_type = kvstore
fields_list = _key,field1,field2
Now I ran the search below to load data onto my kvstore lookup
|inputlookup old_data,csv | table field1,field2 | outputlookup samplekv_lookup
When I run | inputlookup samplekv_lookup | eval Key = _key | table _key,field1,field2 , I see the data with columns key, field1 & field2
Now I want to edit the data in this kvstore. I tried using the Lookup File Editor App for Splunk Enterprise. When opened in the list of lookups, I found "samplecollection" instead of "samplekv_lookup" (I was hoping to see this in the list).
Once I open "samplecollection" to edit in the Lookup Editor app, it only shows me _key column and it doesn't show me the field1, field2 columns which I want to edit.
Is my understanding correct that tje Lookup Editor app can be used to edit kvstore data? What am I doing wrong?
Any help is much appreciated.
... View more