topic Re: lookup doesn't work in macro in Splunk Search

lookup doesn't work in macro

dadi — Mon, 28 Sep 2020 13:01:46 GMT

hi guys,
I've this following command that works perfectly in search query, but doesn't work in macro:

.... | lookup myfile.csv userId

The error i get is:
"Error in 'lookup' command: Could not find all of the specified lookup fields in the lookup table."

Does anyone has an idea?

some more info-
the search query is:
cohortCalcVisitsLookup("-4w@w1", "-3w@w1", "@w1", weeklyCohort.csv, "weeklyVisits")

screenshot:

Thanks!

Re: lookup doesn't work in macro

lguinn2 — Sun, 30 Dec 2012 22:39:51 GMT

What app is the macro in? What app are you running in when you do this from the command line?

Re: lookup doesn't work in macro

dadi — Sun, 30 Dec 2012 22:44:06 GMT

Its the same app. If i search for the lookup inline it works, but if I wrap it in a macro and run it from the same search web page (now only call the macro instead of the explicit lookup call), then it fails with this error.

Re: lookup doesn't work in macro

lguinn2 — Sun, 30 Dec 2012 22:58:28 GMT

Can you show the complete text of the macro - and also the complete command line using the macro?

What do you see when you use the Search Job Inspector? It usually shows the macro expansion - so you cn see the full search string.

Re: lookup doesn't work in macro

dadi — Mon, 31 Dec 2012 06:27:50 GMT

added info in question. Thanks!

Re: lookup doesn't work in macro

lguinn2 — Mon, 31 Dec 2012 19:11:09 GMT

This is what you said you did on the command line:

.... | lookup myfile.csv

But this is what the macro does:

... | lookup "$lookupCsv$" userId

Expanded in to the example used in the screenshot, it would be

... | lookup "weeklyCohort.csv" userId

-- assuming that your macro arguments are in the correct order.

These do not look the same to me at all.

Also, what fields are in the weeklyCohort.csv file?

Re: lookup doesn't work in macro

dadi — Tue, 01 Jan 2013 08:45:18 GMT

Thanks for your answer.
I'm sorry, I've updated the macro section of the question with many details but kept the command line in psuedo code. In fact the command line is also doing lookup with userId and I've added this info to the question.

The fields in weekly cohort are _time, userId, weeklyVisits, firstTime.

Any ideas?

Re: lookup doesn't work in macro

lguinn2 — Tue, 01 Jan 2013 15:53:50 GMT

Weird - I have no idea why it doesn't work! BUT, I do have ideas about how to figure it out - apologies if you have already tried these.

Copy off the first part of the macro, including the lookup command, into a new macro.
Run the new macro and use the Search Job Inspector to look at how it parsed.
Run the first part from the command line as well, again using the inspector.
Try explicitly naming the output fields:

lookup lookup "$lookupCsv$" userId OUTPUT _time as eTime weeklyVisits firstTime
Note that I have renamed the _time field, so that it does not conflict with the existing field. I am not sure if this is causing the problem, but you were potentially overwriting a built-in field...
If none of this works, then I am out of ideas. I'd suggest that you file a support ticket. Or perhaps someone else will know the answer.

Re: lookup doesn't work in macro

dadi — Wed, 02 Jan 2013 10:16:25 GMT

after some more investigation - It seems that the problem is not in the lookup command but rather on the next phase when I'm taking one of the lookup output parameter and try to use them ($visits$ in my example). If I inline this parameter then it works

Re: lookup doesn't work in macro

lguinn2 — Wed, 02 Jan 2013 16:15:56 GMT

Hmm, that was a crummy error message from Splunk - it really pointed at the lookup command!!