https://community.splunk.com/t5/Splunk-Search/Error-using-lookup-table/m-p/199749#M57865 <P>Hello</P> <P>I am running the following search with the end aim of using the 'map' functionality to plot the results but when I run the query an error is returned advising</P> <P>Error in 'lookup' command: Could not find all of the specified lookup fields in the lookup table.</P> <P>The search I am running is</P> <P>sourcetype="netscaler" | iplocation IPADDRESS | eval GeoLocation=case(Country="Australia", "Views from Australia", Country!="Australia", "International Views") | search GeoLocation="Views from Australia" NOT City="" OR Country="" | eval City=Upper(City) | lookup geoLocations_lookup City OUTPUT lat lon</P> <P>I have verified that the lookup table is correct and it can be viewed using the | inputlookup call.</P> <P>If I remove the lookup and run the query all works and the 'City' information is returned. I can then run further searches using City=XXXXX so it must be picking up the City name/value correctly so I am puzzled as to why the search fails using the lookup command.</P> <P>Any help would be greatly appreciated.</P> <P>Ps.. I know there is a Google Maps App but that is also giving us grief running in a distributed environment so I am hoping to use the above as an alternative.</P> <P>Cheers,</P> <P>Alastair</P> Wed, 18 Jun 2014 05:40:06 GMT ahogbin 2014-06-18T05:40:06Z https://community.splunk.com/t5/Splunk-Search/Error-using-lookup-table/m-p/199749#M57865 <P>Hello</P> <P>I am running the following search with the end aim of using the 'map' functionality to plot the results but when I run the query an error is returned advising</P> <P>Error in 'lookup' command: Could not find all of the specified lookup fields in the lookup table.</P> <P>The search I am running is</P> <P>sourcetype="netscaler" | iplocation IPADDRESS | eval GeoLocation=case(Country="Australia", "Views from Australia", Country!="Australia", "International Views") | search GeoLocation="Views from Australia" NOT City="" OR Country="" | eval City=Upper(City) | lookup geoLocations_lookup City OUTPUT lat lon</P> <P>I have verified that the lookup table is correct and it can be viewed using the | inputlookup call.</P> <P>If I remove the lookup and run the query all works and the 'City' information is returned. I can then run further searches using City=XXXXX so it must be picking up the City name/value correctly so I am puzzled as to why the search fails using the lookup command.</P> <P>Any help would be greatly appreciated.</P> <P>Ps.. I know there is a Google Maps App but that is also giving us grief running in a distributed environment so I am hoping to use the above as an alternative.</P> <P>Cheers,</P> <P>Alastair</P> Wed, 18 Jun 2014 05:40:06 GMT https://community.splunk.com/t5/Splunk-Search/Error-using-lookup-table/m-p/199749#M57865 ahogbin 2014-06-18T05:40:06Z https://community.splunk.com/t5/Splunk-Search/Error-using-lookup-table/m-p/199750#M57866 <P>Fixed... a silly mistake on my behalf in that I had the reference column called by the incorrect name.</P> Wed, 18 Jun 2014 06:01:50 GMT https://community.splunk.com/t5/Splunk-Search/Error-using-lookup-table/m-p/199750#M57866 ahogbin 2014-06-18T06:01:50Z