topic Re: Lookup table does not exist . It is referenced by configuration 'yyyy' in Splunk Dev

Lookup table does not exist . It is referenced by configuration 'yyyy'

florencegoh — Thu, 12 Oct 2017 09:50:13 GMT

Hi,
When configuring the lookup table, i receive the following error The lookup table 'xxxx' does not exist. It is referenced by configuration 'yyyyy'.
index=main sourcetype=yyyy [|inputlookup xxxx.csv |fields account_name] | chart count(username) by username

The objective of is to find a list of accounts listed in xxxx.csv field and count the number of time the user login from the sourcetype yyyy.

Please advise what could be the error

Re: Lookup table does not exist . It is referenced by configuration 'yyyy'

493669 — Thu, 12 Oct 2017 13:13:31 GMT

IS lookup table 'xxxx' is automatic lookup?

Re: Lookup table does not exist . It is referenced by configuration 'yyyy'

hardikJsheth — Thu, 12 Oct 2017 13:20:31 GMT

Did you check permission of lookup table?? If you fire following query are you getting any output??

|inputlookup xxx.csv

I would suggest that you use lookup command instead of inputlookup, for example

index=main sourcetype=yyyy |lookup xxxx.csv username output  account_name | chart count(username) by username

Re: Lookup table does not exist . It is referenced by configuration 'yyyy'

florencegoh — Fri, 13 Oct 2017 02:25:30 GMT

Getting the outputs of the table when running "|inputlookup.csv.

I have run that suggested command. but still getting the error as "could not find all the specified lookup fields in the lookup table".

Any suggestion ?

Re: Lookup table does not exist . It is referenced by configuration 'yyyy'

493669 — Fri, 13 Oct 2017 04:46:45 GMT

Hi florencegoh,
It seems to be permission issue.
so include Below Stanza in metadata>default.meta -

[props/<sourcetype_name>/LOOKUP-<Automatic_Lookup_Name>]
export = none

Re: Lookup table does not exist . It is referenced by configuration 'yyyy'

florencegoh — Fri, 13 Oct 2017 08:28:59 GMT

Hi,
where do you configure that ? New to it.

Regards,

Re: Lookup table does not exist . It is referenced by configuration 'yyyy'

493669 — Fri, 13 Oct 2017 08:39:55 GMT

You can add that stanza in file "default.meta" present inside metadata folder

Re: Lookup table does not exist . It is referenced by configuration 'yyyy'

hardikJsheth — Mon, 16 Oct 2017 05:23:43 GMT

Can you confirm presence of the column "account_name" in your lookup file which is extracted from lookup file?