I am using Splunk Enterprise 6.4.7. I have created a kvstore by defining the collection in collections.conf
`[definitions]`
and providing the config is transforms.conf
`
[definitions_lu]
collection=definitions
external_type=kvstore
field_list=_key, name,def,tag
`
I have populated the kvstore via the rest endpoints.
I am now trying to create an Automatic Lookup based on the "name" field in the kvstore.
I keep getting the error from my indexers that "The lookup table 'definitions_lu' does not exist" What do I need to do to get the indexers to recognize the table?
↧