Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Not able to edit kvstore lookups with lookup editor app

$
0
0
Hi I have created a kvstore collection as below in collections.conf [samplecollection] replicate = true Then i created a lookup based on above kvstore collection in transforms.conf [samplekv_lookup] collection = samplecollection external_type = kvstore fields_list = _key,field1,field2 Now i ran below query to load data onto my kvstore lookup |inputlookup old_data,csv | table field1,field2 | outputlookup samplekv_lookup When i run "| inputlookup samplekv_lookup | eval Key = _key | table _key,field1,field2" i see the data with columns key, field1 & field2 Now i want to edit the data in this kvstore. I tried using the lookup editor app. When opened in the list of lookups, i found "samplecollection" instead of "samplekv_lookup"(I was hoping to see this in the list). Once I open "samplecollection" to edit in the lookup editor app, it only shows me _key column it doesn't show me the field1,field2 columns which i want to edit. Is my understanding rite that lookup editor app can be used to edit kvstore data? what am I doing wrong Any help is much appreciated.

Viewing all articles
Browse latest Browse all 47296

Trending Articles