I notice that whenever I create a KV-store lookup definition with a field containing a '.' character, it does not work properly. Surrounding the fieldname with """ does not help.
Writing to the lookup with the outputlookup command results in the message:
"Could not write to collection 'my_collection': An error occurred while saving to the KV Store.
When I remove the '.' character(s) from the field names in de lookup definition it works again.
According to mongodb
Restrictions on Field Names
Field names cannot contain the null character.
Top-level field names cannot start with the dollar sign ($) character.
Otherwise, starting in MongoDB 3.6, the server permits storage of field names that contain dots (i.e. .) and dollar signs (i.e. $).
I know Splunk 7 uses an older version of mongodb (3.4 perhaps), I believe Splunk 7.2.x uses 3.6 but I also could not use "." characters in field names in that version, so I suspect you will need to avoid the $ symbol and the . symbol is field names via kvstore.