topic Re: splunk lookup not working! in Splunk Search

splunk lookup not working!

cassie90 — Fri, 29 Apr 2011 02:41:25 GMT

Hi, I just created a static CSV file for the splunk lookup. But when I upload it, it didn't appear in the pick field. I follow the exact same step in the tutorial but it just didn't work out.

My CSV file has:

DestinationIP,owner_id,owner

118.214.191.45,1,Noam Freedman

209.85.175.106,2,Google Inc.

66.220.149.32,3,Facebook Inc.

124.155.223.9,4,NOC SHI

I would like the splunk to display whenever they lookup the IP address they would know the name of the owner. The destination ip address is already in my log file.

Re: splunk lookup not working!

JSapienza — Fri, 29 Apr 2011 11:56:50 GMT

Did you verify the file exists in the users folder ? Example : /opt/splunk/etc/users/admin/search/lookups/

Re: splunk lookup not working!

cassie90 — Tue, 03 May 2011 10:05:23 GMT

yeap is inside already. But it didn't work at all. I can't seems to find it in the pick field.

Re: splunk lookup not working!

rroberts — Tue, 03 May 2011 16:11:39 GMT

What did you have in your pipe to lookup command for input and output?

Re: splunk lookup not working!

cassie90 — Wed, 04 May 2011 04:11:25 GMT

what do you mean by my pipe?

Re: splunk lookup not working!

e82than — Wed, 04 May 2011 05:44:55 GMT

your pipe as in the key next to the right closing square brackets which you have to use when you do a stats command or an eval command.

give us an example (paste the search command) of your search string and let us see if you're doing the right thing?

Re: splunk lookup not working!

cassie90 — Mon, 28 Sep 2020 09:31:35 GMT

[Website1.zip:./Website/Website]
LOOKUP-find_owner_name = find_owner_name DestinationIP AS DestinationIP OUTPUTNEW owner AS owner owner_id AS owner_id

the above one is under props.conf

[find_owner_name]
filename = find_owner_name.csv

and this one is under transforms.conf