Could not construct lookup

gopenshaw — Mon, 14 Oct 2019 09:51:24 GMT

Hi,

I'm having an issue with a splunk lookup and I can't work out what the issue is. I have a lookup file, that among other things contains a mac address field and a hostname field

mac, nt_host
aabbccddeeff, machine1
a1b1c1d1e1f1, machine2

etc.

I then have a search which returns data like the following:

   MAC: AA:BB:CC:DD:EE:FF
   interface: ge-X/X/XX
   switch: SWITCHNAME
   timestamp: 2019-10-14T09:02:02+00:00

I'm trying to match the mac in the lookup table and return the nt_host:

index=os source="logfile" host="logfilehost"
| eval mac = lower(trim(replace(MAC, ":", "")))
| lookup lookupfile mac OUTPUT nt_host

But I get the following error:
Streamed search execute failed because: Error in 'lookup' command: Could not construct lookup 'lookupfile, mac, OUTPUT, dns'. See search.log for more details..

If i run this search it works:

index=os source="logfile" host="logfilehost"
| eval mac = lower(trim(replace(MAC, ":", "")))
| table mac
| lookup lookupfile mac OUTPUT nt_host

but a subsequent stats command then returns the same error again. I'm unsure whats happening here and I see no errors in the search log.

No idea what I'm missing here.

Thanks

Re: Could not construct lookup

gopenshaw — Mon, 28 Oct 2019 11:00:05 GMT

I've realised the problem here is that some values in my lookup file are blank which causes the lookup to fail.

topic Re: Could not construct lookup in Splunk Search

Could not construct lookup

Re: Could not construct lookup