topic Re: inputlookup returning 0 fields in Splunk Search

inputlookup returning 0 fields

j4adam — Tue, 29 Sep 2020 10:23:21 GMT

Hello all,

I've done this a million times, but for some reason, it's not working for me today, and I suspect it's something really silly that just needs some fresh eyes on it.

I have a .csv file:

dest_port,application
1,TCP Port Service Multiplexer (TCPMUX)
5,Remote Job Entry (RJE)
7,ECHO
18,Message Send Protocol (MSP)
20,FTP -- Data
21,FTP -- Control
...etc...

I've created a lookup table file and lookup definition in the same app context. I run | inputlookup known_tcp_ports.csv and I get the table (with the order backwards, application first followed by dest_port).

I created an automatic lookup that has input: dest_port = dest_port (exists in my data and identical name as port header in csv) and the output is application=application. This doesn't work, so I dug into it and even the normal lookup doesn't work!

I'm staring at an event with dest_port=20 right now and when I run index=main sourcetype=web* dest_port=20 [ | inputlookup known_tcp_ports.csv ] I get bupkis.

Any ideas? I'm sure it's something really simple.

Edit: Running index=main dest_ip=* | lookup known_tcp_ports.csv dest_port OUTPUT application gets the application field. Not sure why I have to force it like that.

Re: inputlookup returning 0 fields

sundareshr — Wed, 27 Jul 2016 20:07:07 GMT

Try this search. What do you get?

UPDATED based on comments

index=main sourcetype=web* dest_port=20 | lookup known_tcp_ports.csv dest_port AS dest_port OUTPUT application AS application

Re: inputlookup returning 0 fields

j4adam — Wed, 27 Jul 2016 20:09:39 GMT

I get 285 events but no application field.

Re: inputlookup returning 0 fields

somesoni2 — Wed, 27 Jul 2016 20:10:49 GMT

The subsearch method ( index=main sourcetype=web* dest_port=20 [ | inputlookup known_tcp_ports.csv ] ) is for filtering, not for data enrichment, so there won't be application column there. If the regular lookup work, check the syntax for the automatic lookup is correct and you're running the search is smart/verbose mode.

Re: inputlookup returning 0 fields

sundareshr — Wed, 27 Jul 2016 20:13:59 GMT

If you want the applications field, you will have to use lookup command. Try this

index=main sourcetype=web* dest_port=20 | lookup known_tcp_ports.csv dest_port AS dest_port OUTPUT application AS application

Re: inputlookup returning 0 fields

j4adam — Wed, 27 Jul 2016 20:20:00 GMT

Can you edit your main post to include this so I can accept it and hopefully save future people the headache I went through? 🙂

Re: inputlookup returning 0 fields

j4adam — Wed, 27 Jul 2016 20:20:32 GMT

And there it is. It's for filtering. Sigh. Thanks!