topic Getting error when i called a lookup file in Splunk Search

Getting error when i called a lookup file

pramodkumar — Thu, 10 Jan 2013 05:05:35 GMT

Hi,
Can someone hlep me why am getting this error.. and what i had to do to resolve
"Assuming implicit lookup table with filename 'lookup_test.csv'"
Have given search as ../lookup lookup_test.csv locno as locno OUTPUT locname as locname,
have lookup table structure as
locno,locname,zipcode,city
1,abc,1001,HYD
1,def,1002,CHN
am passing locno and want to fetch "locname" and show in report.
Have added this lookup table from Manager->lookup and provided lookup table location..

Re: Getting error when i called a lookup file

Drainy — Thu, 10 Jan 2013 08:32:04 GMT

Well its not really an error, its telling you that you don't have a definition for that lookup defined so its implicitly assuming you mean the one that its spotted in a lookup directory with the same name.

You can define the lookup in your transforms.conf to remove this notice, e.g.

[lookup_test]
filename = lookup_test.csv

Then you can just use | lookup lookup_test ....
Also, you don't need to do locno as locno, you only need AS if you need to rename the field to match the field names in the lookup, in this case its the same as your Splunk field so you don't need to include AS at all.

Re: Getting error when i called a lookup file

pramodkumar — Mon, 28 Sep 2020 13:04:51 GMT

as you suggested added as
[lookup_test.csv]
filename=lookup_test.csv in transforms.conf and now its working fine as i expected..
thanks for your correct sol.