Project

General

Profile

Feature #1360

Load lookup from selectable user context

Added by Luke Murphey over 8 years ago. Updated over 8 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Luke Murphey
Target version:
2.2
Start date:
06/20/2016
Due date:
% Done:

100%

Description

https://answers.splunk.com/answers/405296/not-able-to-edit-kvstore-lookups-with-lookup-edito.html

Make kv store lookup
Make it via the lookup editor

Make row in kv store lookup
Add a row from the editor

Make transforms.conf

[test_in_search_lookup]
collection = test_in_search
external_type = kvstore
fields_list = _key,test,user,app

Run a search to view the results:

| inputlookup test_in_search_lookup append=t

Make row in kv store lookup via search

* | head 1 | eval test="from_search" | eval user="administrator" | eval app="from_search" | table test user app | inputlookup test_in_search_lookup append=t | outputlookup test_in_search_lookup

Subtasks

Task #1370: Create dropdown with user contextsClosedLuke Murphey

Task #1371: Populate user contexts (for those without admin perms)ClosedLuke Murphey

Task #1372: Populate user contexts (for those with admin perms)ClosedLuke Murphey

Task #1373: Load lookup with selected user contextClosedLuke Murphey

Feature #1374: Update URLClosedLuke Murphey

Feature #1375: Indicate which user context was loadedClosedLuke Murphey

History

#1 Updated by Luke Murphey over 8 years ago

A couple things.

The lookup editor lists KV store lookups by collection name. It ignores transforms.conf.

Editing of KV lookups won't be available when:

1. The platform doesn't support KV store. It must be Splunk 6.2 or greater and must be the 64-bit platform.
 2. The KV store service is not running. If some issue prevents the KV store from running, then the KV editing will not be available.
 3. If the particular KV store lookup has restrictive ACLs that prevents the Lookup Editor from accessing it.

#2 Updated by Luke Murphey over 8 years ago

Wierd.

  1. When I do the repro steps and inputlookup/outputlookup the results, the lookup then has nothing in the KV store editor. Adding another row in the editor causes the new row to be added but still doesn't appear in inputlookup.

#3 Updated by Luke Murphey over 8 years ago

This is likely due to storing rows under different users (nobody versus admin).

#4 Updated by Luke Murphey over 8 years ago

This is the root cause. outputlookup stores and inputlookup retrieves rows only for the nobody user whereas the KV editor uses the user that owns the lookup.

#5 Updated by Luke Murphey over 8 years ago

  • Status changed from New to In Progress
  • Target version set to 2.2

#6 Updated by Luke Murphey over 8 years ago

  • Tracker changed from Bug to Feature
  • Subject changed from Cannot edit KV store lookup to Load lookup from selectable user context
  • Assignee set to Luke Murphey

#7 Updated by Luke Murphey over 8 years ago

  • Status changed from In Progress to Closed

Also available in: Atom PDF