topic Re: lookup command not working while inputlookup working in Splunk Search

lookup command not working while inputlookup working

Mrig342 — Tue, 04 Jan 2022 11:29:43 GMT

Hi All,

I have a .csv file named Master_List.csv added to splunk lookup. It has the values of the fields "Tech Stack", "Environment", "Region" and "host" and has about 350 values per field. After adding the lookup table, inputlookup command is working fine and is giving the output table.

But when I am using lookup command in the below query, I am not getting the fields in the output on the left-hand side even though all the required permissions have been provided:

index=tibco_main sourcetype="NON-DIGITAL_TIBCO_INFRA_FS" | regex _raw!="^\d+(\.\d+){0,2}\w"
| regex _raw!="/apps/tibco/datastore"
| rex field=_raw "(?ms)\s(?<Disk_Usage>\d+)%"
| rex field=_raw "(?ms)\%\s(?<File_System>\/\w+)"
| rex field=_raw "(?P<Time>\w+\s\w+\s\s\d+\s\d+\:\d+\:\d+\s\w+\s\d+)\s\d"
| rex field=_raw "(?ms)\d\s(?<Total>\d+(\.\d+){0,2})\w\s\d" | rex field=_raw "(?ms)G\s(?<Used>\d+(\.\d+){0,2})\w\s\d"
| lookup Master_List.csv "Environment"

Can someone please guide me on how to get the lookup command working or help modify the command.

Thank you..

Re: lookup command not working while inputlookup working

ITWhisperer — Tue, 04 Jan 2022 11:58:32 GMT

You don't appear to have an Environment field extracted, should you be looking up by host instead?

Re: lookup command not working while inputlookup working

Mrig342 — Tue, 04 Jan 2022 12:21:18 GMT

Hi ITWhisperer,

I tried with "host" too instead of "Environment". It didn't work either. Can you suggest why..?

Re: lookup command not working while inputlookup working

ITWhisperer — Tue, 04 Jan 2022 12:23:52 GMT

What values for host do you have in your events and what values do you have in you csv file? Perhaps there is a mismatch?

Re: lookup command not working while inputlookup working

Mrig342 — Wed, 05 Jan 2022 04:09:19 GMT

Hi ITWhisperer,

There is no mismatch between the hosts available in the events and the csv file. However, now I am able to see the fields coming up and the lookup command is working fine. Don't know how it worked now, but seems my requirement is fulfilled.

Thank you.