https://community.splunk.com/t5/Splunk-Search/Why-is-my-lookup-search-returning-error-quot-All-of-the-fields/m-p/281455#M84916 <P>Hello All,</P> <P>I am a Splunk noob, and I am trying to make a lookup work. Specifically, I am creating a lookup table of IP addresses, which I then want to compare to my outbound firewall connections which target the IPs in the lookup.</P> <P>Sample from the lookup CSV (file named bad_guys.csv):</P> <PRE><CODE>Mal_IPs, 12.34.56.78, 22.33.44.55, </CODE></PRE> <P>Sample Search:</P> <PRE><CODE>sourcetype="cisco:asa" [lookup bad_guys.csv Mal_IPs as dest_ip] </CODE></PRE> <P>When I run this search, I get the following error:</P> <PRE><CODE>Error in 'lookup' command: All of the fields in the lookup table are specified as lookups, leaving no destination fields. </CODE></PRE> <P>Pretty sure I am doing something bone-headed, but can't seem to figure out what it is. Any ideas? Thanks in advance!</P> Wed, 14 Dec 2016 21:20:20 GMT shanesmith30286 2016-12-14T21:20:20Z https://community.splunk.com/t5/Splunk-Search/Why-is-my-lookup-search-returning-error-quot-All-of-the-fields/m-p/281455#M84916 <P>Hello All,</P> <P>I am a Splunk noob, and I am trying to make a lookup work. Specifically, I am creating a lookup table of IP addresses, which I then want to compare to my outbound firewall connections which target the IPs in the lookup.</P> <P>Sample from the lookup CSV (file named bad_guys.csv):</P> <PRE><CODE>Mal_IPs, 12.34.56.78, 22.33.44.55, </CODE></PRE> <P>Sample Search:</P> <PRE><CODE>sourcetype="cisco:asa" [lookup bad_guys.csv Mal_IPs as dest_ip] </CODE></PRE> <P>When I run this search, I get the following error:</P> <PRE><CODE>Error in 'lookup' command: All of the fields in the lookup table are specified as lookups, leaving no destination fields. </CODE></PRE> <P>Pretty sure I am doing something bone-headed, but can't seem to figure out what it is. Any ideas? Thanks in advance!</P> Wed, 14 Dec 2016 21:20:20 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-my-lookup-search-returning-error-quot-All-of-the-fields/m-p/281455#M84916 shanesmith30286 2016-12-14T21:20:20Z https://community.splunk.com/t5/Splunk-Search/Why-is-my-lookup-search-returning-error-quot-All-of-the-fields/m-p/281456#M84917 <P>Not a bone-headed question, there is a fix and what you did was what I started off doing as well.</P> <P>The challenge is that when using the lookup command with a lookup that has a single value in it, you need to have an OUTPUT defined otherwise, it does not have anything to show for the lookup that it performed.</P> <P>In your case, <CODE>| lookup bad_guys.csv Mal_IPs as dest_ip OUTPUT Mal_IPs</CODE> is what I would probably do.<BR /><BR /> Keep in mind, that will return all relevant rows in the search whether or not a match occurs. The next line under my lookup would likely be <CODE>| search Mal_IPs=*</CODE> which will just return values that have a Mal_IPs in it, those will be the matches.</P> <P>There are other ways of doing this as well but hopefully this gets you going in the right direction.</P> Thu, 05 Oct 2017 13:07:04 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-my-lookup-search-returning-error-quot-All-of-the-fields/m-p/281456#M84917 jstoner_splunk 2017-10-05T13:07:04Z https://community.splunk.com/t5/Splunk-Search/Why-is-my-lookup-search-returning-error-quot-All-of-the-fields/m-p/281457#M84918 <P>Thanks <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> </P> Wed, 12 Feb 2020 22:26:14 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-my-lookup-search-returning-error-quot-All-of-the-fields/m-p/281457#M84918 MuhammadAbdelAa 2020-02-12T22:26:14Z