topic Re: Lookups not working in Getting Data In

Lookups not working

desi-indian — Mon, 28 Sep 2020 10:11:31 GMT

I am running splunk4.2.2 on Linux servers

On My search-heads under /app/splunk/etc/system/local

props.conf entries

[syslog_vrsn]

TZ = US/Eastern
REPORT-rsysog = rsyslog_extractions

lookup_deparment = IpLookup log_ip OUTPUT dept_name

transforms.conf entries
[rsyslog_extractions]
REGEX = (\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(.*)
FORMAT = log_date::"$1" time::"$2" log_ip::"$3" log_host::"$4" facility::"$5" seveority::"$6" Message::"$12"
WRITE_META = false

Under /app/splunk/etc/system/lookups

IpLookup.csv entries

10.174.27.246,nw_grp_SUCCESS
10.174.159.249,SUCCESS_PENDING

I am still getting The lookup table 'IpLookup' does not exist. It is referenced by configuration 'syslog_vrsn' and Its pointing to Indexers ..I even pushed the same config to Indexers But splunk still says "IpLookup" missining I even copied Iplookup.csv to Iplookup to see If the error clears but No luck ..Any help or any one have this issue ?

Re: Lookups not working

Damien_Dallimor — Tue, 06 Dec 2011 19:43:55 GMT

Try this (note, I corrected your "deparment" spelling)

props.conf

LOOKUP-department = IpLookup log_ip OUTPUT dept_name

transforms.conf

[IpLookup]

filename = Iplookup.csv
max_matches = 1

Re: Lookups not working

desi-indian — Wed, 07 Dec 2011 18:07:35 GMT

Thanks for the reply Damien , I tried the file name explicitly but still complains abt "The lookup table 'IpLookup' does not exist. It is referenced by configuration 'syslog_vrsn' "

Re: Lookups not working

Damien_Dallimor — Wed, 07 Dec 2011 21:03:03 GMT

If you log into Splunk Web and browse to :

Manager » Lookups » Lookup table files

Manager » Lookups » Lookup definitions

Do you see the lookup definition and lookup file objects and are the sharing permissions set appropriately ?

Re: Lookups not working

desi-indian — Wed, 07 Dec 2011 21:17:07 GMT

I have already checked those and they show properly

Re: Lookups not working

Damien_Dallimor — Thu, 08 Dec 2011 02:48:09 GMT

What are the "sharing permissions" on the objects ?

Can you post an example of the search you are using ?