https://community.splunk.com/t5/Splunk-Search/How-to-get-multiple-lookups-to-work-in-a-single-search/m-p/556897#M158172 <P>There can be a number of reasons why you get this message.<BR />check permissions on both the lookup file and definition knowledge objects.<BR /><BR />If you&nbsp; use the OUTPUT field, any misspellings will cause it to fail.</P><P>&nbsp;</P><P>I hope that helped</P> Wed, 23 Jun 2021 18:36:02 GMT jrindfleisch 2021-06-23T18:36:02Z https://community.splunk.com/t5/Splunk-Search/How-to-get-multiple-lookups-to-work-in-a-single-search/m-p/139908#M38532 <P>So I am attempting to perform two lookups in a single query, and i'm receiving an error. if I remove the second lookup (doesn't matter which one) then my search returns results normally. </P> <P>Q: is there a way to get multiple lookups to occur in a single query?</P> <P>This is my Search:</P> <PRE><CODE>index=my_index sourcetype="iis" sc_status=2* |lookup status_codes.csv status AS sc_status | lookup my_lookup2.csv field2 AS host | stats count by status_description | rename status_description AS "Status Description" </CODE></PRE> <P>The error that is returned is as follows:</P> <PRE><CODE>&lt;hostname&gt; Streamed search execute failed because: Error in 'lookup' command: The lookup table 'my_lookup2.csv' does not exist. </CODE></PRE> <P>I know the lookup table exists because I can see it on the machine in both the UI and the backend, and it's shared globally. Also, if I attempt to query 'my_lookup2.csv' in a search using it as the only lookup table, then the search works just fine. </P> <P>Is this possible, or a limitation of splunk? </P> Mon, 09 Feb 2015 22:14:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-multiple-lookups-to-work-in-a-single-search/m-p/139908#M38532 tmarlette 2015-02-09T22:14:35Z https://community.splunk.com/t5/Splunk-Search/How-to-get-multiple-lookups-to-work-in-a-single-search/m-p/139909#M38533 <P>Un-related, your query is not using any fields from 2nd lookup, so do you really need that? <BR /> Also, its recommended to perform the lookup further to the right of the search (towards end), preferably after some aggregation. So give this a try</P> <PRE><CODE>index=my_index sourcetype="iis" sc_status=2* | stats count by host, sc_status | lookup status_codes.csv status AS sc_status | lookup my_lookup2.csv field2 AS host | stats sum(count) as count by status_description | rename status_description AS "Status Description" </CODE></PRE> Mon, 09 Feb 2015 22:35:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-multiple-lookups-to-work-in-a-single-search/m-p/139909#M38533 somesoni2 2015-02-09T22:35:17Z https://community.splunk.com/t5/Splunk-Search/How-to-get-multiple-lookups-to-work-in-a-single-search/m-p/139910#M38534 <P>No go unfortunately, this didn't get me what I was looking for. </P> Thu, 12 Feb 2015 18:21:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-multiple-lookups-to-work-in-a-single-search/m-p/139910#M38534 tmarlette 2015-02-12T18:21:59Z https://community.splunk.com/t5/Splunk-Search/How-to-get-multiple-lookups-to-work-in-a-single-search/m-p/139911#M38535 <P>I figured this one out. This is the query in working form:</P> <PRE><CODE>index="my_index" sourcetype="iis" sc_status=2* | localop | lookup status_codes.csv status AS sc_status | lookup myLookup.csv nt_host AS host | search "Field 1"="Value1" | stats count </CODE></PRE> Thu, 12 Feb 2015 18:24:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-multiple-lookups-to-work-in-a-single-search/m-p/139911#M38535 tmarlette 2015-02-12T18:24:34Z https://community.splunk.com/t5/Splunk-Search/How-to-get-multiple-lookups-to-work-in-a-single-search/m-p/139912#M38536 <P>How execution of this SPL (that contains two lookup commands) from local search head and not from the search peers resolve the issue?</P> Sat, 09 Jun 2018 17:00:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-multiple-lookups-to-work-in-a-single-search/m-p/139912#M38536 ppuru 2018-06-09T17:00:46Z https://community.splunk.com/t5/Splunk-Search/How-to-get-multiple-lookups-to-work-in-a-single-search/m-p/556897#M158172 <P>There can be a number of reasons why you get this message.<BR />check permissions on both the lookup file and definition knowledge objects.<BR /><BR />If you&nbsp; use the OUTPUT field, any misspellings will cause it to fail.</P><P>&nbsp;</P><P>I hope that helped</P> Wed, 23 Jun 2021 18:36:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-multiple-lookups-to-work-in-a-single-search/m-p/556897#M158172 jrindfleisch 2021-06-23T18:36:02Z