topic Re: db connect lookup fails with table is invalid in Splunk Search

db connect lookup fails with table is invalid

jl271818 — Mon, 28 Sep 2020 13:46:57 GMT

To use a flat file lookup table is easy - simply create (say) a CSV file and use it with the search app syntax
| inputlookup test.csv

but if I go to
Apps -> Lookups -> database lookups and create a new DB lookup...
In this case a database table exists in an MS SQL database, local to the install of splunk (same machine)
HIP7_SignameXlate

I can get the GUI to query the DB (called ePO) to fill all the columns and save it. This suggests that the permissions etc are fine, and the DB connect app can read the table colums.

Additionally, I can read data using a db tail, proving that the system returns data via the DB CONNECT app.

However, the lookup table does not work. I get the following error:

| INPUTLOOKUP dbo.HIP7_SigNameXlate
The lookup table 'dbo.HIP7_SigNameXlate' is invalid.

I know the spelling is correct as this is a cut and paste.

Any ideas how to troubleshoot this?

Thanks

Re: db connect lookup fails with table is invalid

stefano_guidoba — Tue, 23 Apr 2013 14:38:01 GMT

check here: http://docs.splunk.com/Documentation/DBX/1.0.8/DeployDBX/dblookupspec
Also, using a lookup instead of a inputlookup lets you find something?

Re: db connect lookup fails with table is invalid

jl271818 — Wed, 24 Apr 2013 03:06:06 GMT

No - the lookup does not work... which is why I tried something easy. i.e. inputlookup

Re: db connect lookup fails with table is invalid

ziegfried — Sun, 05 May 2013 03:14:44 GMT

Database lookups are actually scripted lookups in Splunk, so they cannot be used with the inputlookup command, which only supports file based lookups. You can use the dbquery command for a similar purpose, you just have to specify the full SQL query instead of the lookup name.

In order to find out the problem with using the database lookup with the lookup command, could you please provide some more information? (Lookup configuration, example searches you've tried, error messages, parts of dbx.log generated for the executed lookup)

Re: db connect lookup fails with table is invalid

JLeeatCBA — Tue, 21 May 2013 00:03:31 GMT

Thanks. Once one realises that inputlookup won't return results, troubleshooting leads to results. | lookup from a db source works fine. Just have to be sure the data is there and the syntax is right.