topic Re: Splunk Look up Definitions in Splunk Enterprise

Splunk Look up Definitions

keerthana_Reddy — Sun, 05 May 2024 21:49:28 GMT

Hello,

I have created a splunk look up table file( file is in csv format )and now Iam trying to create a look up definition.

But i couldn't create lookup definition because when i tried searching for the look up file , i couldn't get that file in my drop down menu to select.

what could be the reason. can anyone help with this

Thanks in advance

Re: Splunk Look up Definitions

bowesmana — Sun, 05 May 2024 22:13:42 GMT

How did you create the lookup

by uploading a CSV
using the lookup editor
using outputlookup

which app did you create the lookup in and what app are you in when trying to make the lookup definition.

If yo go to the list of lookup files (Lookups->Lookup table files) can you see the lookup there and what are its permissions - make sure you look for all lookups visible in all apps - and check what app your lookup file is in

Re: Splunk Look up Definitions

keerthana_Reddy — Sun, 05 May 2024 22:29:28 GMT

Hii Bowesmana, Thanks for your reply

I created the look up table file by uploading the csv file.

and iam looking in the same app as the one that i created the look up table.

I am actually supposed to get the data from production splunk. so i have very limited access.

The look up table file i created has private access which is visible only to me . would that be an issue ?

Re: Splunk Look up Definitions

bowesmana — Sun, 05 May 2024 23:33:16 GMT

A private lookup created in App A can ONLY be seen in app A, so if you try to create the lookup definition in app B, then it will not show the CSV in the dropdown

If your lookup is listed like the above, your username (red) and app (blue), then I believe it should be possible to create a definition in the same app for a private lookup - so if you cannot see your lookup in the dropdown, it may be a result of permissions - I am not sure, but if you can change your lookup permissions to app, you could see if that changes it.