topic Re: Lookup missing definition in Splunk Search

Lookup missing definition

victornajduch — Wed, 21 Jul 2021 20:36:29 GMT

Good afternoon,

I can't make sense of why I can't extract a definition from a particular csv.
I doublechecked permissions and verified that all of my columns are appearing via | inputlookup file.csv | table loopback, device

the output recognizes both the custom device data as well as loopback but if I attempt to table the info "device" is not recognized.

index=index "syslog message"
| rex field=_raw "peer (?<neighbor>\d+.\d+.\d+.\d+.)" | dedup neighbor

| lookup xo-access-loopback loopback as neighbor output device | table device, neighbor

I get neighbor output but not device.
csv looks like -
Any ideas?

device	loopback
routername	x.x.x.x

Re: Lookup missing definition

venkatasri — Wed, 21 Jul 2021 23:40:59 GMT

Hi @victornajduch

I am hoping 'neighbor' is correctly extracted. The lookup file could be sometimes having hidden chars not visible through normal text editors, you can try opening it using vi/vim/emacs editors to find and clear these chars.

---

An upvote would be appreciated and Accept solution if this reply helps!

Re: Lookup missing definition

venkatasri — Wed, 21 Jul 2021 23:43:07 GMT

@victornajduch Similar issue has been answered here - Solved: Error in 'lookup' command: Cannot find the source ... - Splunk Community

Re: Lookup missing definition

victornajduch — Thu, 22 Jul 2021 17:11:09 GMT

@venkatasri checked for special characters and added a 3 (superfluous) column. No change.