topic Re: lookup command is not working in Splunk REST API in Splunk Search

Why is lookup command not working in Splunk REST API?

georgear7 — Tue, 24 Jan 2023 16:17:10 GMT

I'm consuming data from Splunk REST API endpoints for other purposes. However, it is throwing this error because I used the "lookup" command in the query. Could anyone assist me in resolving this issue?

If the "lookup" command is not used, the query works properly.

Error:
<?xml version="1.0" encoding="UTF-8"?>
<response>
<messages>
<msg type="FATAL">Error in 'lookup' command: Could not construct lookup 'master_sheet.csv, host, as, host, OUTPUT, LOB, Region, Application, Environment'. See search.log for more details.</msg>
</messages>
</response>

curl -u user:pass -k https://localhost:8089/services/search/jobs/mysearch_1234567/results --get -d output_mode=csv

Re: lookup command is not working in Splunk REST API

manjunathmeti — Tue, 24 Jan 2023 07:05:23 GMT

Hi @georgear7,

1. Check if you can run the query in the search app
2. Check the API user role permissions to master_sheet.csv in Splunk

Re: lookup command is not working in Splunk REST API

georgear7 — Mon, 30 Jan 2023 05:45:19 GMT

Hi @manjunathmeti ,

1. Check if you can run the query in the search app - Yes, it's runing fine & producing results
2. Check the API user role permissions to master_sheet.csv in Splunk - Lookup file is owned by my ID. So there should not be any permission issue.

Re: lookup command is not working in Splunk REST API

manjunathmeti — Mon, 30 Jan 2023 06:23:23 GMT

Check search.log in Search job inspector for search SID.

Activity >> Jobs

Re: lookup command is not working in Splunk REST API

Perichila — Mon, 19 Jun 2023 10:32:10 GMT

Hello @georgear7 ,

I have the same problem, i am unable to run queries with lookups in Splunk with python.

Have you fix that problem?

Thanks

Re: lookup command is not working in Splunk REST API

isoutamo — Wed, 28 Jun 2023 08:40:52 GMT

have you try /servicesNS/ instead of /services/ ? Like this

curl -ku $PASS https://localhost:8089/servicesNS/nobody/search/search/jobs --data-urlencode ....

r. Ismo