topic Re: help on lookup error in Splunk Search

Why am I receiving this lookup error?

jip31 — Tue, 10 May 2022 14:12:28 GMT

When I call the lookup like below it works fine

| inputlookup test.csv

but when I use the lookup in a search I have the message below

Error in 'lookup' command: Could not construct lookup

here is the lookup

what I have to do please?

Re: help on lookup error

gcusello — Tue, 10 May 2022 08:02:10 GMT

Hi @jip31,

did you created the lookup definition? {settings -- Lookups -- Lookup Definitions]

Ciao.

Giuseppe

Re: help on lookup error

jip31 — Tue, 10 May 2022 08:25:11 GMT

hello

yes

Re: help on lookup error

gcusello — Tue, 10 May 2022 08:34:08 GMT

Hi @jip31,

could you share your search and the conf files containing the lookup?

Ciao.

Giuseppe

Re: help on lookup error

ITWhisperer — Tue, 10 May 2022 08:35:12 GMT

Can you complete the picture with the search or at least the line you used in the search which is giving you this error?

Re: help on lookup error

jip31 — Tue, 10 May 2022 17:04:31 GMT

Here is the csv

and the search

| lookup deb.csv entite as site output s espace | stats last(site) as site, last(espace) as espace by s

Re: Why am I receiving this lookup error?

jip31 — Wed, 11 May 2022 14:50:52 GMT

is anybody can explain me what is wrong in my csv please?

Re: Why am I receiving this lookup error?

ITWhisperer — Wed, 11 May 2022 15:51:09 GMT

What do you get when you do this:

| inputlookup deb.csv

Re: Why am I receiving this lookup error?

jip31 — Wed, 11 May 2022 16:01:19 GMT

At the beginning it was working but when I executed the search, I did have the message below

Error in 'lookup' command: Could not construct lookup

But now when I try to upload the file, Splunk tells me

The lookup table 'debit.csv' requires a .csv or KV store lookup definition.

Here is the csv

https://www.cjoint.com/c/LElp7nHLilB

Re: Why am I receiving this lookup error?

ITWhisperer — Wed, 11 May 2022 16:37:13 GMT

Looks like you need to address that error! 😀

Re: Why am I receiving this lookup error?

jip31 — Thu, 12 May 2022 05:12:55 GMT

What do you mean exactly ?

Re: Why am I receiving this lookup error?

ITWhisperer — Thu, 12 May 2022 05:20:05 GMT

Thoroughly check your definitions to see if everything is correct - you could try recreating the key store to see if that fixes your issue.

Re: Why am I receiving this lookup error?

jip31 — Thu, 12 May 2022 06:56:46 GMT

I done it and now | inputlookup deb.csv works fine

But when I run my searches the lookup doesnt works with 2 different case

If I run this, I have no error but the csv is not taken into account

| lookup deb.csv sam espace as site output entite debit | stats last(site) as "Espace" by sam

And if I run this, I have the message "Error in 'lookup' command: Could not construct lookup"

| lookup deb.csv espace as site output entite debit sam | stats last(site) as "Espace" by sam

There is no empty fields in the csv

https://www.cjoint.com/c/LElp7nHLilB

What is wrong please?

Re: Why am I receiving this lookup error?

ITWhisperer — Thu, 12 May 2022 07:29:05 GMT

sam doesn't exist in the csv list you provided but I suspect that's just a typo as you would have got a different error otherwise.

How big is your csv file?

What does the job inspector report?

Re: Why am I receiving this lookup error?

jip31 — Thu, 12 May 2022 08:23:49 GMT

sam is the CSV example correspond to "s" field

the csv size is 4 ko

here is some info from the job inspector

Re: Why am I receiving this lookup error?

ITWhisperer — Sun, 15 May 2022 10:05:56 GMT

Have you tried using "AS" instead of "as" in your lookup command?

Re: Why am I receiving this lookup error?

jip31 — Mon, 16 May 2022 08:40:36 GMT

it changes nothing, same message and same result

If you look at the error message, i think the csv is not interpreted correctly because you can see the fields are not separated correctly

Could not construct lookup 'debit.csv, entite, AS, site, output, sam, espace

But I dont understand what is wrong because when I am doing | inputlookup debit.csv, the data are correctly displayed

Re: Why am I receiving this lookup error?

jip31 — Thu, 02 Jun 2022 05:17:47 GMT

Is anybody can help please?

Re: Why am I receiving this lookup error?

jip31 — Mon, 13 Jun 2022 06:22:11 GMT

Is anybody can help please?

Re: Why am I receiving this lookup error?

ILoveMangoes99 — Mon, 19 Feb 2024 18:06:50 GMT

No sure if you've resolved this issue yet, but you can try to make sure your csv file is in this format? The format you have is a coma-delimited, but Splunk lookup table may not like that particular format. So you may want to try to fix the lookup table to make it look like this? Just sharing my suggestion. I encountered something that looks similar to this issue. Hope this helps. 🙂