I have created a kvstore collection as below in collections.conf
[samplecollection] replicate = true
Then I created a lookup based on the above kvstore collection in transforms.conf
[samplekv_lookup] collection = samplecollection external_type = kvstore fields_list = _key,field1,field2
Now I ran the search below to load data onto my kvstore lookup
|inputlookup old_data,csv | table field1,field2 | outputlookup samplekv_lookup
When I run
| inputlookup samplekv_lookup | eval Key = _key | table _key,field1,field2, I see the data with columns key, field1 & field2
Now I want to edit the data in this kvstore. I tried using the Lookup File Editor App for Splunk Enterprise. When opened in the list of lookups, I found "samplecollection" instead of "samplekv_lookup" (I was hoping to see this in the list).
Once I open "samplecollection" to edit in the Lookup Editor app, it only shows me _key column and it doesn't show me the field1, field2 columns which I want to edit.
Is my understanding correct that tje Lookup Editor app can be used to edit kvstore data? What am I doing wrong?
Any help is much appreciated.
I'm looking into this. I'll be tracking the work under http://lukemurphey.net/issues/1360 for details. I suspect this has something to do with ability in KV store to have rows on a per-user basis.
I figured out what is going on. outputlookup stores and inputlookup retrieves rows only for the nobody user whereas the KV editor uses the user that owns the lookup.
Version 2.2 of the lookup editor allows you to select the user context in which to view the rows. This will allow you to select "nobody" which includes the rows that outputlookup stores and inputlookup works with.
I have actually found the issue here. Your problem is your collection.conf:
replicate = true
You don't specifically state the columns in your collection.
I just got this app and I immediately looked at my current setup through it. Every time I am missing a column it's a column that I don't enforce a type with in collections.conf.
The _key column seems to just be a given.
Question: may I assume that when you edited the lookup from search using outputlookup that you did so from a user account other than admin? I think I have been able to reproduce the issue but I need to make sure it is the same issue.