topic Re: How do I resolve "Error in 'lookup' command" after configuring a lookup definition in transforms.conf? in Splunk Search

How do I resolve "Error in 'lookup' command" after configuring a lookup definition in transforms.conf?

diavolo — Tue, 29 Sep 2020 11:46:15 GMT

I configured external lookup definition with a script I built. However, the lookup command fails with the following message.

Error in 'lookup' command: The lookup table 'mylookup' does not exist or is not available.

SPL Command:
... | lookup mylookup myfield

$SPLUNK_HOME/etc/apps/myapp/local/transforms.conf:

[mylookup]
external_cmd = get_lookup.py
fields_list =Title,Genre,Country,imdbRating

I placed get_lookup.py in $SPLUNK_HOME/etc/apps/myapp/bin/.
What's wrong with the lookup definition?

(Splunk Ver: 6.5 / OS: Mac OS X)

dmaislin_splunk — Mon, 07 Nov 2016 16:16:02 GMT

Did you restart Splunk after you placed that file?

cdoebert — Mon, 07 Nov 2016 21:02:09 GMT

Does Splunk have access to get_lookup.py? The file perms might be overriding the dir perms.

diavolo — Mon, 07 Nov 2016 23:59:31 GMT

Yes, of course I did.

diavolo — Tue, 08 Nov 2016 00:05:01 GMT

Yes, I granted 755 to the py script. The owner is the same as the one who runs splunkd.

kikeyama — Tue, 08 Nov 2016 00:15:43 GMT

What is the permission of lookup definition (Private, App only, or Global) and which app did you execute lookup command in?

diavolo — Wed, 09 Nov 2016 03:16:40 GMT

You're right. I created it in custom app with App permission but used the command at search app. Thank you.