topic Re: Error in 'lookup' command: Cannot find the source field in Splunk Search

Error in 'lookup' command: Cannot find the source field

ktell — Tue, 29 Jun 2021 20:39:41 GMT

I have a csv lookup table of IP addresses that I want to execute searches on server logs with, but I'm stopped by an error code (title). It tells me the source field (IP) isn't found in the lookup table (IP_lookup), but my lookup definition lists IP as a supported field. I've also tried adding the lookup field through the data model builder (no luck).

Search query is

index="ef" | lookup IP_lookup IP as clientip OUTPUT IP2 as IP Address

For context, my lookup table has two duplicate columns of addresses. Any help would be appreciated.

Re: Error in 'lookup' command: Cannot find the source field

venkatasri — Tue, 29 Jun 2021 22:42:09 GMT

@ktell

That's strange! can you execute | inputlookup IP_lookup and share the 'field names/columns' exactly as they return they are case sensitive?

You query requires a quotes around something like this - Share the exact error that you are getting.

index="ef" | lookup IP_lookup IP as clientip OUTPUT IP2 as "IP Address"

Re: Error in 'lookup' command: Cannot find the source field

ktell — Tue, 29 Jun 2021 22:52:08 GMT

@venkatasri

inputlookup returns IP and IP2 along with all the addresses in 2 columns

Full error message reads;

Error in 'lookup' command: Cannot find the source field 'IP' in the lookup table 'IP_lookup'.

Re: Error in 'lookup' command: Cannot find the source field

venkatasri — Wed, 30 Jun 2021 00:35:54 GMT

@ktell can you follow this link and find if csv having any special chars inside - Re: Error in 'lookup' command: Could not find all ... - Splunk Community

Is there lookup definitions already configured in backend props.conf related to same IP_lookup ?

Re: Error in 'lookup' command: Cannot find the source field

ktell — Wed, 30 Jun 2021 00:46:53 GMT

@venkatasri I'm not at my workstation anymore, I'll give your suggestions a try tomorrow or setup one later

Re: Error in 'lookup' command: Cannot find the source field

ktell — Thu, 01 Jul 2021 17:00:14 GMT

Thanks for the suggestion, I'm not familiar with vi but I was able to get a clean csv file by avoiding notepad