https://community.splunk.com/t5/Splunk-Search/Why-the-second-csv-cannot-be-read-with-inputlookup-commond/m-p/372657#M161697 <P>I have 1.csv which can by read by splunk with<BR /> |inputlookup 1.csv<BR /> Now I uploaded 2.csv.<BR /> When I enter |inputlookup 2.csv, result of 1.csv is displayed in splunkweb.<BR /> By the way, if i upload the 2.csv in other splunk server, 2.csv can be read.<BR /> How can i fix this problem?</P> Fri, 24 Mar 2017 07:50:17 GMT xiyangyang 2017-03-24T07:50:17Z https://community.splunk.com/t5/Splunk-Search/Why-the-second-csv-cannot-be-read-with-inputlookup-commond/m-p/372657#M161697 <P>I have 1.csv which can by read by splunk with<BR /> |inputlookup 1.csv<BR /> Now I uploaded 2.csv.<BR /> When I enter |inputlookup 2.csv, result of 1.csv is displayed in splunkweb.<BR /> By the way, if i upload the 2.csv in other splunk server, 2.csv can be read.<BR /> How can i fix this problem?</P> Fri, 24 Mar 2017 07:50:17 GMT https://community.splunk.com/t5/Splunk-Search/Why-the-second-csv-cannot-be-read-with-inputlookup-commond/m-p/372657#M161697 xiyangyang 2017-03-24T07:50:17Z https://community.splunk.com/t5/Splunk-Search/Why-the-second-csv-cannot-be-read-with-inputlookup-commond/m-p/372658#M161698 <P>Even i enter <BR /> |inputlookup *<BR /> The 1.csv is shown in splunk web.<BR /> Doesn't it strang?</P> Fri, 24 Mar 2017 08:19:51 GMT https://community.splunk.com/t5/Splunk-Search/Why-the-second-csv-cannot-be-read-with-inputlookup-commond/m-p/372658#M161698 xiyangyang 2017-03-24T08:19:51Z https://community.splunk.com/t5/Splunk-Search/Why-the-second-csv-cannot-be-read-with-inputlookup-commond/m-p/372659#M161699 <P>Gak. You actually named the files 1.csv and 2.csv? Try with myfile3.csv and see if you get the same issues.</P> <P>There are separate sections of the interface, one for uploading lookup tables and one for uploading other csvs. which did you use? Did you use the lookup table interface to upload the table, and then to define the table? </P> Fri, 24 Mar 2017 15:30:59 GMT https://community.splunk.com/t5/Splunk-Search/Why-the-second-csv-cannot-be-read-with-inputlookup-commond/m-p/372659#M161699 DalJeanis 2017-03-24T15:30:59Z https://community.splunk.com/t5/Splunk-Search/Why-the-second-csv-cannot-be-read-with-inputlookup-commond/m-p/372660#M161700 <P>@xiyangyang which version of Splunk are you using? I was unable to recreate this. I am able to access both files through inputlookup in Splunk 6.5.2.</P> Fri, 24 Mar 2017 20:38:39 GMT https://community.splunk.com/t5/Splunk-Search/Why-the-second-csv-cannot-be-read-with-inputlookup-commond/m-p/372660#M161700 niketn 2017-03-24T20:38:39Z https://community.splunk.com/t5/Splunk-Search/Why-the-second-csv-cannot-be-read-with-inputlookup-commond/m-p/372661#M161701 <P>If this is true, it is a bug. However, I am <EM>exceedingly</EM> skeptical that it is true. Do the whole thing again with <CODE>3.csv</CODE> and <CODE>4.csv</CODE>. I am sure that you will spot your mistake. Be sure to name EVERYTHING differently.</P> Sat, 25 Mar 2017 07:00:15 GMT https://community.splunk.com/t5/Splunk-Search/Why-the-second-csv-cannot-be-read-with-inputlookup-commond/m-p/372661#M161701 woodcock 2017-03-25T07:00:15Z https://community.splunk.com/t5/Splunk-Search/Why-the-second-csv-cannot-be-read-with-inputlookup-commond/m-p/372662#M161702 <P>Pretty silly thing but tried clearing cache and cookies?? </P> Sun, 26 Mar 2017 08:46:20 GMT https://community.splunk.com/t5/Splunk-Search/Why-the-second-csv-cannot-be-read-with-inputlookup-commond/m-p/372662#M161702 varad_joshi 2017-03-26T08:46:20Z https://community.splunk.com/t5/Splunk-Search/Why-the-second-csv-cannot-be-read-with-inputlookup-commond/m-p/372663#M161703 <P>The files names are actually zenkoku.csv and cate.csv. <BR /> The contents are totally different.<BR /> I used "Lookup table files" in Settings menu.<BR /> I cannot recreate this in other splunk sever either.<BR /> I tried to delete cookie and history in browser, but nothing changed.</P> Mon, 27 Mar 2017 00:59:24 GMT https://community.splunk.com/t5/Splunk-Search/Why-the-second-csv-cannot-be-read-with-inputlookup-commond/m-p/372663#M161703 xiyangyang 2017-03-27T00:59:24Z https://community.splunk.com/t5/Splunk-Search/Why-the-second-csv-cannot-be-read-with-inputlookup-commond/m-p/372664#M161704 <P>Actually the files name is zenkoku.csv and cate.csv. The contents are totally differnet.</P> Mon, 27 Mar 2017 01:18:30 GMT https://community.splunk.com/t5/Splunk-Search/Why-the-second-csv-cannot-be-read-with-inputlookup-commond/m-p/372664#M161704 xiyangyang 2017-03-27T01:18:30Z https://community.splunk.com/t5/Splunk-Search/Why-the-second-csv-cannot-be-read-with-inputlookup-commond/m-p/372665#M161705 <P>Thank you for your advice. It didn't work.</P> Mon, 27 Mar 2017 01:20:34 GMT https://community.splunk.com/t5/Splunk-Search/Why-the-second-csv-cannot-be-read-with-inputlookup-commond/m-p/372665#M161705 xiyangyang 2017-03-27T01:20:34Z https://community.splunk.com/t5/Splunk-Search/Why-the-second-csv-cannot-be-read-with-inputlookup-commond/m-p/372666#M161706 <P>My splunk version is 6.2.3.<BR /> I did this successful with 6.2.3 splunk server.</P> Mon, 27 Mar 2017 01:24:19 GMT https://community.splunk.com/t5/Splunk-Search/Why-the-second-csv-cannot-be-read-with-inputlookup-commond/m-p/372666#M161706 xiyangyang 2017-03-27T01:24:19Z https://community.splunk.com/t5/Splunk-Search/Why-the-second-csv-cannot-be-read-with-inputlookup-commond/m-p/372667#M161707 <P>what is the destination filename you have specified when you have uploaded each file?</P> Mon, 27 Mar 2017 02:00:28 GMT https://community.splunk.com/t5/Splunk-Search/Why-the-second-csv-cannot-be-read-with-inputlookup-commond/m-p/372667#M161707 pranav_agile 2017-03-27T02:00:28Z https://community.splunk.com/t5/Splunk-Search/Why-the-second-csv-cannot-be-read-with-inputlookup-commond/m-p/372668#M161708 <P>Both of 2 files are uploaded in D:\Splunk\etc\apps\search\lookups.<BR /> Other files were uploaded too, but none of them can be viewed by inputlookup comment. Please refer the picture.</P> Mon, 27 Mar 2017 02:42:03 GMT https://community.splunk.com/t5/Splunk-Search/Why-the-second-csv-cannot-be-read-with-inputlookup-commond/m-p/372668#M161708 xiyangyang 2017-03-27T02:42:03Z https://community.splunk.com/t5/Splunk-Search/Why-the-second-csv-cannot-be-read-with-inputlookup-commond/m-p/372669#M161709 <P>The picture of file names of my all csv.file.<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/2671i2358679D31642200/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Mon, 27 Mar 2017 02:43:03 GMT https://community.splunk.com/t5/Splunk-Search/Why-the-second-csv-cannot-be-read-with-inputlookup-commond/m-p/372669#M161709 xiyangyang 2017-03-27T02:43:03Z https://community.splunk.com/t5/Splunk-Search/Why-the-second-csv-cannot-be-read-with-inputlookup-commond/m-p/372670#M161710 <P>The request of <BR /> |inputlookup *<span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/2672i598E60071160D4C4/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Mon, 27 Mar 2017 02:44:41 GMT https://community.splunk.com/t5/Splunk-Search/Why-the-second-csv-cannot-be-read-with-inputlookup-commond/m-p/372670#M161710 xiyangyang 2017-03-27T02:44:41Z https://community.splunk.com/t5/Splunk-Search/Why-the-second-csv-cannot-be-read-with-inputlookup-commond/m-p/372671#M161711 <P>This problem has been fixed. Something was wrong with the transform.conf.</P> Mon, 08 May 2017 02:16:46 GMT https://community.splunk.com/t5/Splunk-Search/Why-the-second-csv-cannot-be-read-with-inputlookup-commond/m-p/372671#M161711 xiyangyang 2017-05-08T02:16:46Z https://community.splunk.com/t5/Splunk-Search/Why-the-second-csv-cannot-be-read-with-inputlookup-commond/m-p/372672#M161712 <P>Please explain what changes you made to transforms.conf so future readers may benefit.</P> Mon, 08 May 2017 02:19:15 GMT https://community.splunk.com/t5/Splunk-Search/Why-the-second-csv-cannot-be-read-with-inputlookup-commond/m-p/372672#M161712 richgalloway 2017-05-08T02:19:15Z https://community.splunk.com/t5/Splunk-Search/Why-the-second-csv-cannot-be-read-with-inputlookup-commond/m-p/372673#M161713 <P>We simply forgot to comment out "----".</P> <H2>Wrong transform.conf:</H2> <P>【zenkoku_lookup】<BR /> filename = zenkoku.csv</P> <H2>match_type = WILDCARD(city)</H2> <P>Correct transform.conf:</P> <H1>----------------------------</H1> <P>【zenkoku_lookup】<BR /> filename = zenkoku.csv<BR /> match_type = WILDCARD(city)</P> <H1>----------------------------</H1> Tue, 29 Sep 2020 14:02:34 GMT https://community.splunk.com/t5/Splunk-Search/Why-the-second-csv-cannot-be-read-with-inputlookup-commond/m-p/372673#M161713 xiyangyang 2020-09-29T14:02:34Z https://community.splunk.com/t5/Splunk-Search/Why-the-second-csv-cannot-be-read-with-inputlookup-commond/m-p/372674#M161714 <P>You should click <CODE>Accept</CODE> on this answer to close the question.</P> Fri, 12 May 2017 05:44:49 GMT https://community.splunk.com/t5/Splunk-Search/Why-the-second-csv-cannot-be-read-with-inputlookup-commond/m-p/372674#M161714 woodcock 2017-05-12T05:44:49Z