(A customer has converted a CSV lookup to a KV Store lookup. What must be done to make it available for an automatic lookup?)

Question

Options

• AAdd the repFactor=true attribute in collections.conf.
• Bhas no effect, as KV Store replication is controlled exclusively via collections.conf.
• CAdd the replicate=true attribute in collections.conf.
• DAdd the repFactor=true attribute in lookups.conf.

• A
  4% (1)
• B
  14% (4)
• C
  75% (21)
• D
  7% (2)

Explanation

Splunk's KV Store management documentation specifies that when converting a static CSV lookup to a KV Store lookup, the lookup data is stored in a MongoDB-based collection defined in collections.conf. To ensure that the KV Store lookup is replicated and available across all search head cluster members, administrators must include the attribute replicate=true within the collections.conf This configuration instructs Splunk to replicate the KV Store collection's data to all members in the Search Head Cluster (SHC), enabling consistent access and reliability across the cluster. Without this attribute, the KV Store collection would remain local to a single search head, making it unavailable for automatic lookups performed by other members. Here's an example configuration snippet from collections.conf: [customer_lookup] replicate = true field.name = string field.age = number The attribute repFactor=true (mentioned in Options A and D) is unrelated to KV Store behavior-it applies to index replication, not KV Store replication. Similarly, replicate=true in lookups.conf (Option Once properly configured, the lookup can be defined in transforms.conf and referenced in props.conf for automatic lookup functionality. - KV Store Collections and Configuration - collections.conf Reference - Managing KV Store Data in Search Head Clusters - Automatic Lookup Configuration Using KV Store - Splunk Enterprise Admin Manual - Distributed KV Store Replication Settings

No community discussion yet for this question.