https://community.splunk.com/t5/Splunk-Search/Lookup-Table/m-p/47565#M11354 <P>You have to pick either OUTPUT or OUTPUTNEW - you can't have both. For example:</P> <PRE><CODE>[source_type_w] LOOKUP-HLookup = HLookup w AS word OUTPUTNEW e </CODE></PRE> <P>This setup also implies that the csv file starts with a header that looks like this:</P> <PRE><CODE>w,e </CODE></PRE> Tue, 28 May 2013 19:46:27 GMT lguinn2 2013-05-28T19:46:27Z https://community.splunk.com/t5/Splunk-Search/Lookup-Table/m-p/47564#M11353 <P>I am attempting to use an external lookup table against some twitter data.</P> <P>My Transforms.conf file reads:<BR /> [HLookup]<BR /> filename = HLookup.csv </P> <P>Props.conf reads:<BR /> [source_type_w]<BR /> LOOKUP-HLookup = HLookup w AS word OUTPUT|OUTPUTNEW e</P> <P>I however get the error:<BR /> Could not find all of the specified lookup fields in the lookup table.' for conf 'source_type_w' and lookup table 'HLookup'.</P> <P>I am at my wits end as to why this is happening.It looks simple enough <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span></P> Mon, 28 Sep 2020 13:59:26 GMT https://community.splunk.com/t5/Splunk-Search/Lookup-Table/m-p/47564#M11353 Abha 2020-09-28T13:59:26Z https://community.splunk.com/t5/Splunk-Search/Lookup-Table/m-p/47565#M11354 <P>You have to pick either OUTPUT or OUTPUTNEW - you can't have both. For example:</P> <PRE><CODE>[source_type_w] LOOKUP-HLookup = HLookup w AS word OUTPUTNEW e </CODE></PRE> <P>This setup also implies that the csv file starts with a header that looks like this:</P> <PRE><CODE>w,e </CODE></PRE> Tue, 28 May 2013 19:46:27 GMT https://community.splunk.com/t5/Splunk-Search/Lookup-Table/m-p/47565#M11354 lguinn2 2013-05-28T19:46:27Z https://community.splunk.com/t5/Splunk-Search/Lookup-Table/m-p/47566#M11355 <P>Thanks! <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Wed, 29 May 2013 09:28:40 GMT https://community.splunk.com/t5/Splunk-Search/Lookup-Table/m-p/47566#M11355 Abha 2013-05-29T09:28:40Z