KB 173: Master Inventory Lookup not showing any data in Splunk Cloud
Platform: Splunk Cloud
Version: 1 from 10.03.2023
Dropdowns using the master_inventory_lookup do not populate in the PowerConnect App for Splunk dashboards in Splunk Cloud environments.
The Master Inventory Lookup is KVstore based. A Splunk Cloud bug is causing the supported fields list in the lookup definition to be misinterpreted, resulting in the lookup showing no results in search despite data being present in the underlying KV collection.
As a temporary workaround, this lookup should be converted to a CSV file-based lookup:
Create a new CSV lookup called master_inventory_lookup.csv in the Splunk App for Lookup File Editing. Ensure that it is blank and associate it with the SAP PowerConnect for Splunk application as indicated in the screenshots below.
Return to the SAP PowerConnect for PowerConnect application.
Go to Settings → Lookups → Lookup Definitions.
Search for and open the master_inventory_lookup definition under the SAP PowerConnect for Splunk app.
Change the definition Type to file-based.
In the Lookup file, set the value to master_inventory_lookup.csv. Save the lookup definition.
In the PowerConnect app, go to Settings → Searches, reports, and alerts.
Select All from the Owner dropdown.
Search “Master Inventory Lookup” and find the “Master Inventory Lookup - Lookup Gen - Run Once Only” search. Run this search.
After the search concludes please proceed to any of the dashboards within the PowerConnect Splunk app. The dropdowns will now work as designed.