topic Re: Help needed with lookup error in Knowledge Management

Help needed with lookup error

Roy_9 — Wed, 04 Oct 2023 04:01:47 GMT

Anyone have an idea on the below issue?

| inputlookup test
the lookup table file and definition both are available, both of the permissions are set to read(everyone)- set to app level, but when i am trying to inputlookup i am seeing the error.

Initially the lookup definition is set to read everyone and lookup file is set to read admin, so i changed it to everyone this afternoon and tried the below search but i am still getting below error

| inputlookup test

The lookup table 'test' requires a .csv or KV store lookup definition.
The lookup table 'test' is invalid.

Btw this is on Production Search head in a clustered environment

Re: Help needed with lookup error

yeahnah — Wed, 04 Oct 2023 04:30:04 GMT

Hi @Roy_9

Assuming the lookup file is called test.csv, does this command work?

| inputlookup test.csv

If so, it would indicate a problem with the lookup definition. Maybe try deleting and recreating it.

Hope that helps

Re: Help needed with lookup error

Roy_9 — Wed, 04 Oct 2023 04:39:56 GMT

@yeahnah even after deleting and recreating the lookup definition wouldn't help. i am still seeing the issue. i tired in GUI.

Re: Help needed with lookup error

Roy_9 — Wed, 04 Oct 2023 12:12:10 GMT

@VatsalJagani @PickleRick Can you please help me with this?

Re: Help needed with lookup error

VatsalJagani — Wed, 04 Oct 2023 12:15:01 GMT

@Roy_9 - Are you running the search in the same App where you created the lookup definition?

Re: Help needed with lookup error

Roy_9 — Wed, 04 Oct 2023 15:12:12 GMT

Hi @VatsalJagani
I am getting the results, when i am running it inside the same app now but however when i am running the search index="_internal" log_level=ERROR "test.csv" i am still seeing the error.

The lookup table 'test.csv' requires a .csv or KV store lookup definition.

Thanks

Re: Help needed with lookup error

VatsalJagani — Wed, 04 Oct 2023 15:36:09 GMT

@Roy_9 - This query (index="_internal" log_level=ERROR "test.csv") has nothing to do with lookup.

It seems you have Automatic lookup (props.conf) for automatic lookup, which is having similar permission issue, that's what causing it.

Re: Help needed with lookup error

Roy_9 — Wed, 04 Oct 2023 16:56:00 GMT

@VatsalJagani thanks for your message, i just checked the automatic lookups and i don't see one created for test.csv, Am i missing something? Do i need to check somewhere else? please help me

Re: Help needed with lookup error

VatsalJagani — Thu, 05 Oct 2023 15:00:47 GMT

@Roy_9 - Give me your exact search please.

Re: Help needed with lookup error

Roy_9 — Fri, 17 May 2024 13:07:26 GMT

Hello @VatsalJagani

I have the lookup table file and definition where the permissions are set to app level and when i am running the search inside app, it is fetching results but when i am running it in the main search and reporting app i am getting the error this lookup table requires a .csv or kvstore lookup defintion, how do we need to fix this error any idea?

Thanks

Re: Help needed with lookup error

VatsalJagani — Mon, 20 May 2024 05:43:14 GMT

@Roy_9 - Yes, you need to set the Lookup file and Lookup definition permission to set as "Global" instead of Private or App.

You can do that from from UI on their respective page under Settings on Splunk.

I hope this helps!!! Kindly upvote if it does!!!