topic Re: error: 'lookup-table-files': File is binary and not gzipped in Splunk Search

error: 'lookup-table-files': File is binary and not gzipped

yonahol — Wed, 25 Apr 2012 14:45:32 GMT

Hi,
I am trying to add a new lookup table using the GUI and get the above error.
I looked at the file with a hex editor and it looks like a plain ascii file.
Any ideas?
Thx
Yona

Re: error: 'lookup-table-files': File is binary and not gzipped

araitz — Wed, 25 Apr 2012 18:11:44 GMT

Need more information. Perhaps you can let us know your configuration settings, OS, and what the contents of the lookup file are?

Re: error: 'lookup-table-files': File is binary and not gzipped

reed_kelly — Wed, 25 Apr 2012 18:20:02 GMT

Maybe there is a special character in the CSV file. If you are on a unix host, you could try the folowing:

strings orig.csv >new.csv
diff orig.csv new.csv

If the two files are the same, then they probably are plain text.

Re: error: 'lookup-table-files': File is binary and not gzipped

yonahol — Wed, 25 Apr 2012 18:48:42 GMT

I am using a windows 7 machine, the lookup file is the following:
Process,in
LtMSSp,1
Kerberos,1
I looked with a hex editor and could not see any charater except for CR and LF at the end of each line in addition to the text.

Re: error: 'lookup-table-files': File is binary and not gzipped

reed_kelly — Wed, 25 Apr 2012 19:01:24 GMT

Could there be a spurious NULL or ^Z at the end of the file? Did you try cutting and pasting the file into a new text file in Notepad and saving it from there?

Re: error: 'lookup-table-files': File is binary and not gzipped

FRoth — Wed, 02 May 2012 09:56:20 GMT

I had the same problems until I figured out that splunk fails on reading CSV files containing special characters like the German Umlaut chars like "ä", "ö", "ü" or "ß". I suppose the problem would be the same with other special characters in French ("á") and Spanish ("ñ").

Re: error: 'lookup-table-files': File is binary and not gzipped

yonahol — Wed, 02 May 2012 12:54:45 GMT

Thanks every one for the kind help. Just a quick update: I used the same file on another system and things worked just fine. I am still don't understand what is the reason for it not to work on my machine. I looked carefully with a hexeditor and could not find any special character... I will put more time to it next week and will try to update if I find anything interesting.

Re: error: 'lookup-table-files': File is binary and not gzipped

FRoth — Mon, 21 Jan 2013 09:58:06 GMT

I used Notepad++ to fix this problem.
Search for [^\x00-\x7F] in Regex Mode.

Re: error: 'lookup-table-files': File is binary and not gzipped

FRoth — Mon, 21 Jan 2013 12:09:36 GMT

I used Notepad++ to fix this problem.
Search for [^\x00-\x7F] in Regex Mode.

Re: error: 'lookup-table-files': File is binary and not gzipped

jalfrey — Tue, 12 Mar 2013 21:16:05 GMT

I'm generating my .csv file using a python library for csv. I have tried changing my line endings from \r to \n to \r\n
I have also tried using unix2dos and dos2unix to change line endings. I don't see any special characters. I have tried the strings trick. It removed the ^m from the end of the line. That file would also not upload.

BTW I'm using OS X and am wondering if the Mac line endings might be causing the trouble.

Re: error: 'lookup-table-files': File is binary and not gzipped

lguinn2 — Tue, 12 Mar 2013 23:22:30 GMT

Yes, Mac line endings are not accepted. Use Linux line endings instead. I thought dos2unix would take care of this, but I guess not.

I use Komodo Edit (free version) on my Mac and I save my CSV files using its "UNIX line-endings preference". That seems to work for me.

Re: error: 'lookup-table-files': File is binary and not gzipped

stefano_guidoba — Wed, 20 Mar 2013 11:30:03 GMT

Hi,

I've encountered the same problem today. Just open your CSV with Windows Notepad and use "Save As.." paying attention to select UTF-8 in "Encoding" dropdown menu.

Simple as that, now Splunk recognizes the file 🙂

Re: error: 'lookup-table-files': File is binary and not gzipped

tiny3001 — Mon, 16 Sep 2013 07:44:44 GMT

This should be the accepted answer! Worked first time for me.

Re: error: 'lookup-table-files': File is binary and not gzipped

landen99 — Mon, 24 Nov 2014 17:52:46 GMT

Worked for me as well. As a test, before implementing the endcoding change, I selected everything in the file while opened in Notepad with Ctrl-A, cut, and paste, but that did not work. Save as UTF-8 was the solution for me.

Re: error: 'lookup-table-files': File is binary and not gzipped

josuegd — Thu, 06 Jul 2017 19:05:59 GMT

great solution, thanks

Re: error: 'lookup-table-files': File is binary and not gzipped

MuS — Thu, 04 Apr 2019 05:03:16 GMT

Based on the comments, upvotes this answer has been accepted to be the correct one.

cheers, MuS

Re: error: 'lookup-table-files': File is binary and not gzipped

cblanton — Thu, 08 Aug 2019 17:26:14 GMT

I've used this solution previously, but now, the UTF-8 file isn't maintaining the commas and so then the lookup isn't finding the field names. Any ideas?

Re: error: 'lookup-table-files': File is binary and not gzipped

cblanton — Thu, 08 Aug 2019 17:50:10 GMT

figured it out, wasn't following the instructions carefully. @landen99 comment helped. you must open the csv file with notepad, not copy-paste the data into notepad to maintain the commas. hope this helps someone else.