https://community.splunk.com/t5/Splunk-Search/Lookup-error/m-p/130435#M35546 <P>We are collecting log files from various components servers. <BR /> Eg. Collecting logs from 3 hosts application A [ This is the lookup I have used]<BR /> Host1 /app/sdf ; /app/cdf ; /app/ghf <BR /> Host2 /app/sdf ; /app/cdf ; /app/ghf <BR /> Host3 /app/sdf ; /app/cdf ; /app/ghf ; /app/wer/* [ie. /app/wer/1.log,/app/wer/2.log, /app/wer/2.log, so on]</P> <P>For unique logs I have no problem I got the query through this,</P> <P>index=* appid=$appid$ host=$host$ |rename comment as $earliest$ | stats count by host,source | eval type="current" | table host,source,type | append [|inputlookup source.csv | search appid=$appid$ | search host=$host$ | makemv delim=";" source | eval type="existing" | table appid,host,source,type] | stats values(type) as type by host,source | where mvcount(type) =1 | eval reason=if(type="current","Newlogfile","Missingfile") | table host,reason | search reason="Missingfile"</P> <P>I am having two dropdowns for inputs appid and host. It goes fine while dealing with unique files <BR /> i.e For (/app/sdf ; /app/cdf ; /app/ghf ) it matches correctly and return the results.<BR /> But for logs using wildcard, Im confused <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span> [/app/wer/<EM>]<BR /> How to match (/app/wer/</EM>) with lookup values?</P> <P>Kindly suggest some solutions</P> Thu, 18 Sep 2014 14:03:16 GMT splunkn 2014-09-18T14:03:16Z https://community.splunk.com/t5/Splunk-Search/Lookup-error/m-p/130435#M35546 <P>We are collecting log files from various components servers. <BR /> Eg. Collecting logs from 3 hosts application A [ This is the lookup I have used]<BR /> Host1 /app/sdf ; /app/cdf ; /app/ghf <BR /> Host2 /app/sdf ; /app/cdf ; /app/ghf <BR /> Host3 /app/sdf ; /app/cdf ; /app/ghf ; /app/wer/* [ie. /app/wer/1.log,/app/wer/2.log, /app/wer/2.log, so on]</P> <P>For unique logs I have no problem I got the query through this,</P> <P>index=* appid=$appid$ host=$host$ |rename comment as $earliest$ | stats count by host,source | eval type="current" | table host,source,type | append [|inputlookup source.csv | search appid=$appid$ | search host=$host$ | makemv delim=";" source | eval type="existing" | table appid,host,source,type] | stats values(type) as type by host,source | where mvcount(type) =1 | eval reason=if(type="current","Newlogfile","Missingfile") | table host,reason | search reason="Missingfile"</P> <P>I am having two dropdowns for inputs appid and host. It goes fine while dealing with unique files <BR /> i.e For (/app/sdf ; /app/cdf ; /app/ghf ) it matches correctly and return the results.<BR /> But for logs using wildcard, Im confused <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span> [/app/wer/<EM>]<BR /> How to match (/app/wer/</EM>) with lookup values?</P> <P>Kindly suggest some solutions</P> Thu, 18 Sep 2014 14:03:16 GMT https://community.splunk.com/t5/Splunk-Search/Lookup-error/m-p/130435#M35546 splunkn 2014-09-18T14:03:16Z https://community.splunk.com/t5/Splunk-Search/Lookup-error/m-p/130436#M35547 <P>The error suggests your lookup is all input fields and no output fields, so there'd be nothing for Splunk to do. Make sure you use <CODE>OUTPUT</CODE> or <CODE>OUTPUTNEW</CODE> to split the input fields from the output fields in your <CODE>LOOKUP-foo</CODE> definition.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.1.3/Knowledge/Addfieldsfromexternaldatasources#Set_up_a_fields_lookup_based_on_a_static_file">http://docs.splunk.com/Documentation/Splunk/6.1.3/Knowledge/Addfieldsfromexternaldatasources#Set_up_a_fields_lookup_based_on_a_static_file</A></P> Thu, 18 Sep 2014 14:15:05 GMT https://community.splunk.com/t5/Splunk-Search/Lookup-error/m-p/130436#M35547 martin_mueller 2014-09-18T14:15:05Z https://community.splunk.com/t5/Splunk-Search/Lookup-error/m-p/130437#M35548 <P>Martin, thanks for your response. Still am not getting what I want. I have edited the question now<BR /> Could you please suggest? Thanks in advance</P> Fri, 19 Sep 2014 08:04:46 GMT https://community.splunk.com/t5/Splunk-Search/Lookup-error/m-p/130437#M35548 splunkn 2014-09-19T08:04:46Z