topic Re: Why is my inputlookup table not working? in Getting Data In

Why is my inputlookup table not working?

albin111 — Mon, 22 Oct 2018 14:23:27 GMT

I wanted to ask you for some help. I am trying to create a lookup table on Splunk. I can’t make it work and I can't figure out why.

Query: | inputlookup TrainingList.csv

The following are the things I did:

Created the TrainingList.csv file on /opt/splunk/etc/apps/MyApp/lookups
Defined the stanza on /opt/splunk/etc/apps/MyApp/local/transforms.conf

Stanza was defined as:

[TrainingList]
filename = TrainingList.csv

Re: Why is my inputlookup table not working?

kmorris_splunk — Mon, 22 Oct 2018 18:09:29 GMT

Did you do this through the config files, or the GUI? If you did it through the config files, you will probably need to bounce the Search Head or do a debug refresh: https://answers.splunk.com/answers/102568/reload-transforms-conf-without-restarting-splunk.html

Re: Why is my inputlookup table not working?

albin111 — Mon, 22 Oct 2018 19:21:04 GMT

I did it directly in the config files. I've restarted the server, I did the debug/refresh thing too. I don't know what else to do LOL.

Re: Why is my inputlookup table not working?

kmorris_splunk — Mon, 22 Oct 2018 19:22:36 GMT

Have you tried doing it through the GUI?

Re: Why is my inputlookup table not working?

albin111 — Mon, 22 Oct 2018 19:32:06 GMT

Nope. I'm so used to doing everything through the console that I always neglect the GUI. I will try and see.

Re: Why is my inputlookup table not working?

albin111 — Mon, 22 Oct 2018 19:44:20 GMT

Sadly, I don't have the Datasets addon. I cannot just download it because of security reasons. If you know any short term solution, please share.

Re: Why is my inputlookup table not working?

harsmarvania57 — Tue, 23 Oct 2018 08:23:24 GMT

Hi,

How are you accessing this lookup table, with query | inputlookup TrainingList.csv OR | inputlookup TrainingList?

In which app are you accessing this lookup in Splunk GUI ? For example if you are running above query in Search & Reporting app and MyApp has default sharing permission to App level only, then lookup file or lookup definition which created in MyApp will have app level permission and you will not able to search those lookup files and lookup definitions in other apps. In this case either change MyApp App permission to Global level with read access to everyone OR change lookup file & lookup definition in MyApp from App level to Global.

Re: Why is my inputlookup table not working?

albin111 — Tue, 23 Oct 2018 13:18:22 GMT

Permissions and context were ok. I deleted everything and managed to create it through the GUI and works. Thanks all for the help.

Re: Why is my inputlookup table not working?

albin111 — Tue, 23 Oct 2018 13:19:24 GMT

I managed to delete the file and recreate it through the GUI. Thanks.

Re: Why is my inputlookup table not working?

mstjohn_splunk — Thu, 25 Oct 2018 21:01:44 GMT

hi @albin111,

did you figure out an answer to this problem?