Knowledge Management

Kv store lookup table is invalid

493669
Super Champion

Hi,
I am trying to create kv store lookup by adding below stanza in transforms.conf and collections.conf.
Currently I am using Windows OS and splunk is 6.4.5 (Free version) standalone.
in transforms.conf-
[test_store]
external_type = kvstore
collection = test_collection
fields_list = Name, Country

and in collections.conf-
[test_collection]
field.Name = string
field.Country = string

after when i search |inputlookup test_store
it gives error as "The lookup table 'test_store' is invalid."

I had read few articles so did the following things.
1. Created server.conf in local
[kvstore]
disabled=false
2. Checked for mongod.log file I find the following lines-
98 Unable to create/open lock file: C:\Program Files\Splunk\var\lib\splunk\kvstore\mongo\mongod.lock errno:5 Access is denied.. Is a mongod instance already running?, terminating
2017-03-12T10:01:26.970Z I CONTROL [initandlisten] dbexit: rc: 100

Kindly advise.

0 Karma

jkat54
SplunkTrust
SplunkTrust

do you have multiple mongod.exe in task manager?

do you have multiple splunk installs running?

Mongod gives this error when the port is already in use. Or if it exits improperly and the lock file is left behind. You can try manually removing the lock file after verifying splunk is stopped and mongod.exe isnt running otherwise...

C:\Program Files\Splunk\var\lib\splunk\kvstore\mongo\mongod.lock <- the lock file

0 Karma

493669
Super Champion

@jkat54,
splunk single instance is running and i have not seen mongod.exe running in task manager. also i deleted mongod.lock but still i am not able to create kv store lookup.
i am able to create csv lookup but not kv store
also in lookup editor app i tried creating kv store lookup but still it gives error as "The KV store collection could not be created"

Kindly advise

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...