Error in 'inputlookup' command

terryloar — Mon, 28 Sep 2020 12:01:53 GMT

I get the following error:

"Error in 'inputlookup' command: This command must be the first command of a search."

FOR

source="/home/loart/dev/Splunk/Test_Logs/nepoc_access_small.log" | inputlookup month_year.csv

AND

source="/home/loart/dev/Splunk/Test_Logs/nepoc_access_small.log" | inputlookup month_year

However, inputlookup is indeed the first command, month_year.csv is defined, and month_year is a valid lookup.

Re: Error in 'inputlookup' command

Drainy — Thu, 05 Jul 2012 18:27:44 GMT

To use inputlookup it must be the first command, e.g.

| inputlookup blah.csv

To use it later in a search you use it like so;

sourcetype=blah | inputlookup append=t blah.csv