https://community.splunk.com/t5/Splunk-Search/Database-lookup-during-search-returning-error-1-and-error-47/m-p/286317#M86693 <P>I apologize - I'm a Splunk newbie and my Splunk sysadmin won't answer any questions and says the problem isn't with Splunk (I obviously suspect otherwise).</P> <P>I have created a database lookup. The credentials used are verified good. I know that Splunk is able to talk to the database, as it is able to pre-fill the database column names. But every time I try to run a search with the lookup command, it generates two warnings <EM>"Script for lookup table 'LOOKUP NAME' returned error code 47. Results may be incorrect."</EM> And the same with error code 1.</P> <P>Based on other threads here, I tried running </P> <PRE><CODE>index=_internal sourcetype=dbx_debug severity=ERROR OR severity=FATAL </CODE></PRE> <P>and that returned nothing. Stripping out the severity returned 27 records for the past 15 minutes, all of which look normal.</P> <P>I've created a clone of the database lookup with a CSV, and when I run the same search, but substitute the file system lookup for the database lookup, it works fine. Did I simply mis-configure the database lookup somehow?</P> <P>I know that the table will return &gt;10,000 rows (about 14,700 specifically) - is that the problem?</P> <P>What else can I do to troubleshoot, assuming I don't have access to the Splunk file system?</P> <P>Thanks in advance for your suggestions!</P> Thu, 07 Apr 2016 21:38:34 GMT vysean 2016-04-07T21:38:34Z https://community.splunk.com/t5/Splunk-Search/Database-lookup-during-search-returning-error-1-and-error-47/m-p/286317#M86693 <P>I apologize - I'm a Splunk newbie and my Splunk sysadmin won't answer any questions and says the problem isn't with Splunk (I obviously suspect otherwise).</P> <P>I have created a database lookup. The credentials used are verified good. I know that Splunk is able to talk to the database, as it is able to pre-fill the database column names. But every time I try to run a search with the lookup command, it generates two warnings <EM>"Script for lookup table 'LOOKUP NAME' returned error code 47. Results may be incorrect."</EM> And the same with error code 1.</P> <P>Based on other threads here, I tried running </P> <PRE><CODE>index=_internal sourcetype=dbx_debug severity=ERROR OR severity=FATAL </CODE></PRE> <P>and that returned nothing. Stripping out the severity returned 27 records for the past 15 minutes, all of which look normal.</P> <P>I've created a clone of the database lookup with a CSV, and when I run the same search, but substitute the file system lookup for the database lookup, it works fine. Did I simply mis-configure the database lookup somehow?</P> <P>I know that the table will return &gt;10,000 rows (about 14,700 specifically) - is that the problem?</P> <P>What else can I do to troubleshoot, assuming I don't have access to the Splunk file system?</P> <P>Thanks in advance for your suggestions!</P> Thu, 07 Apr 2016 21:38:34 GMT https://community.splunk.com/t5/Splunk-Search/Database-lookup-during-search-returning-error-1-and-error-47/m-p/286317#M86693 vysean 2016-04-07T21:38:34Z https://community.splunk.com/t5/Splunk-Search/Database-lookup-during-search-returning-error-1-and-error-47/m-p/286318#M86694 <P>I have the exact same issue. The only 'solution' I find relates to a double \ for the db server which I do not have. What is error code 47 ? It must have a description ?</P> Mon, 11 Apr 2016 12:22:30 GMT https://community.splunk.com/t5/Splunk-Search/Database-lookup-during-search-returning-error-1-and-error-47/m-p/286318#M86694 jasonbew 2016-04-11T12:22:30Z https://community.splunk.com/t5/Splunk-Search/Database-lookup-during-search-returning-error-1-and-error-47/m-p/286319#M86695 <P>I gave up on this. </P> <P>Thanks to this thread (and specifically <STRONG>jpass</STRONG>'s response): <A href="https://answers.splunk.com/answers/79893/dbconnect-can-we-populate-a-lookup-table-from-database-data-on-a-period-basis.html">https://answers.splunk.com/answers/79893/dbconnect-can-we-populate-a-lookup-table-from-database-data-on-a-period-basis.html</A>, I've configured a periodic CSV dump out of the database, which is probably a more efficient method anyway, given the relatively infrequent data changes.</P> Mon, 11 Apr 2016 15:22:01 GMT https://community.splunk.com/t5/Splunk-Search/Database-lookup-during-search-returning-error-1-and-error-47/m-p/286319#M86695 vysean 2016-04-11T15:22:01Z https://community.splunk.com/t5/Splunk-Search/Database-lookup-during-search-returning-error-1-and-error-47/m-p/286320#M86696 <P>I have the exact same problem...but my DB contains more than 30 millions entries...a CSV dump is not an option...</P> Tue, 13 Sep 2016 09:08:51 GMT https://community.splunk.com/t5/Splunk-Search/Database-lookup-during-search-returning-error-1-and-error-47/m-p/286320#M86696 tpaulsen 2016-09-13T09:08:51Z