All Apps and Add-ons

Lookup File Editor App for Splunk Enterprise: Why am I getting "KV Store is not supported on this version of Splunk"?

parik517
New Member

I am using Splunk 6.5.1 and a clustered search head, and I get the below error when I go to new lookup tab in the app.

KV Store is not supported on this version of Splunk; upgrade to Splunk 6.2 or later for KV Store support.
0 Karma

LukeMurphey
Champion

The Lookup Editor currently doesn't support being renamed. It has some static references that will cause it to fail if the name is changed.

I have actually considered supporting renaming but the work isn't trivial. I might do it in the future though.

0 Karma

LukeMurphey
Champion

Can you try two things:

1) See if there are Javascript errors in the browser console?
2) Try going to /en-US/splunkd/__raw/servicesNS/nobody/-/storage/collections/config?count=-1&output_mode=json and seeing what the output is?

The Lookup Editor attempts to determine if your Splunk install is KV store incapable by seeing if Splunk returns a 404 HTTP response code to that URL (a 404 indicates that the KV store is not available).

0 Karma

parik517
New Member

1) I see error in browser console like below
en-US/splunkd/_raw/servicesNS/nobody/lookup_editor/storage/collections/config?count=-1&output_mode=json&=1484104023136

Failed to load resource: the server responded with a status of 404 (Not Found)

2) The url which you gave with namespace - works fine however namespace lookup_editor gives below error

{"messages":[{"type":"ERROR","text":"Application does not exist: lookup_editor"}]}

0 Karma

LukeMurphey
Champion

Could you try going to the following URL and telling me if you get the same message?

en-US/splunkd/__raw/servicesNS/nobody/lookup_editor/saved/searches
0 Karma

LukeMurphey
Champion

That's strange. I'm not sure why Splunk would say that the app "lookup_editor" doesn't exist given that this is the app making the call. I'm guessing this is some nuance with SHC.

It is easy enough for me to change the call in the Lookup Editor but let me talk to some people to make sure that I understand how SHC is supposed to work in this context so that I can make sure my fix is appropriate.

0 Karma

Venkat_16
Contributor

This issue occurs when you change the app folder name to something else.
Restore the original directory name, this should be fixed.

0 Karma

LukeMurphey
Champion

That is definitely true. @parik517: could you confirm that the folder name had been changed?

0 Karma

parik517
New Member

Yes Folder name has been changed. After correction its working fine.

0 Karma

LukeMurphey
Champion

Ok, I'll post answer to that so that it is clear to other people. I suspect this will happen again since it isn't uncommon for people to rename that app (especially due to the way that deployment server works).

0 Karma

LukeMurphey
Champion

Given that I have a reasonable suspicion that this is a bug in the app, I went ahead and made a bug ticket to track this: https://lukemurphey.net/issues/1680

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Do you have the 32-bit version of Splunk? KV store requires the 64-bit version.

---
If this reply helps you, Karma would be appreciated.
0 Karma

parik517
New Member

I am using 64-bit version.

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...