topic Re: how to use universal source type for lookup a multiple indexs in Splunk Search

how to use universal source type for lookup a multiple indexs

linu1988 — Tue, 05 Feb 2013 05:11:14 GMT

I want to use two lookups where the logged in user roles are input to the 1st lookup and the 2nd lookup is fed by the result of 1st look up. But while implementing at the server i am getting "could not find fields for lookup table , conf missing the relevant fields error. Can any body help in this?

First Csv contains Second Csv Contains

Roles,Server Server,tier
admin,A A,C
User,B B,D

Re: how to use universal source type for lookup a multiple indexs

Ayn — Tue, 05 Feb 2013 08:24:31 GMT

More details please. What do your config files look like? How are you calling your lookups?

Re: how to use universal source type for lookup a multiple indexs

Ayn — Tue, 05 Feb 2013 08:51:15 GMT

When you call it on different indexed data, exactly how are you calling it? Because the error message really says it - you're telling it to use lookup fields that don't exist in the lookups you're calling.

Re: how to use universal source type for lookup a multiple indexs

linu1988 — Tue, 05 Feb 2013 09:07:55 GMT

i have modified the transforms.conf and props.conf to define the lookup table and definition

SO definition goes like this

[tiers]
Lookup-sample=mylookup Roles OUTPUT Server
Lookup-tier=mytiers Server OUTPUT tier

I am getting the result but when it is applied on different indexed data, i getting Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'tiers' and lookup table 'samplelookup'.

I am using the Rest api to get the user roles then i am looking up for the relevant fields to populate the dropdown from the results

Re: how to use universal source type for lookup a multiple indexs

linu1988 — Tue, 05 Feb 2013 09:51:50 GMT

Ayn, the lookups used contain the fields which are being called from search query. its defined like "| rest /services/authentication/users | lookup samplelookup Role as roles | fields Server| mvexpand Server | Lookup mytiers Servers as Server". Any suggessions on the implementation?

Re: how to use universal source type for lookup a multiple indexs

Ayn — Tue, 05 Feb 2013 10:42:46 GMT

You're using the lookup command wrong. You're specifying "Role as roles", but it should be the other way around - "roles as Role" (and same thing for the other lookup).

Re: how to use universal source type for lookup a multiple indexs

linu1988 — Tue, 05 Feb 2013 11:15:58 GMT

Thanks for the explanation Ayn, With some modifications it started working. 🙂