topic Re: Lookup table does not append value to event in Splunk Search

Lookup table does not append value to event

samlinsongguo — Fri, 19 May 2017 05:45:06 GMT

I have a lookup table as below
User IsMember
user1 Yes
user2 Yes
user3 No

I save the table as memberlist.csv save as type is CSV(comma delimited)(*.csv)
I import the table and define the lookup (lookupA) as Splunk doc described in the web GUI
Then I run following search

index=A | lookup lookupA User OUTPUT IsMemeber

I expect the commend will add an IsMember value into the event right? but I could not find the field.

Any suggestions abot where I am doing it wrong?

Cheers
Sam

Re: Lookup table does not append value to event

aakwah — Fri, 19 May 2017 06:32:53 GMT

Hello,

For csv lookups I create the files with a text editor or via a script to have a text file at the end, then the contents of memberlist.csv file will be like that:

User,IsMember
user1,Yes
user2,Yes
user3,No

Regards

Re: Lookup table does not append value to event

hunters_splunk — Fri, 19 May 2017 06:39:38 GMT

Hi Sam,

Have you shared your lookup definition with apps? If not, please follow the steps described in the documentation below and try again:

http://docs.splunk.com/Documentation/Splunk/6.6.0/Knowledge/Usefieldlookupstoaddinformationtoyourevents#Share_the_lookup_definition_with_apps

Hope this helps. Thanks!
Hunter

Re: Lookup table does not append value to event

woodcock — Fri, 19 May 2017 14:21:09 GMT

You are using spaces to delimit the field values in your lookup, but you need to be using commas. Change that and it will work just fine.

Re: Lookup table does not append value to event

samlinsongguo — Mon, 22 May 2017 01:28:59 GMT

I have replaced spaces to to commas but still can not see the new field added into each event. What I did was open the .csv file in notepad and replace the spaces between user and IsMember field and save it. and i also tried create .csv file in notepad from start like below but still cant see appended field in each event

userN,isMbr
a,Yes
b,Yes

any ideas where the problem is?

Re: Lookup table does not append value to event

samlinsongguo — Mon, 22 May 2017 01:29:09 GMT

userN,isMbr
a,Yes
b,Yes

any ideas where the problem is?

Re: Lookup table does not append value to event

samlinsongguo — Mon, 22 May 2017 01:30:02 GMT

yes I did, I put all as global for both file and definition

Re: Lookup table does not append value to event

samlinsongguo — Mon, 22 May 2017 01:32:33 GMT

the search I am doing is index=x| lookup test userN OUTPUT isMbr is this right?

Re: Lookup table does not append value to event

samlinsongguo — Mon, 22 May 2017 01:32:43 GMT

the search I am doing is index=x| lookup test userN OUTPUT isMbr is this right?

Re: Lookup table does not append value to event

samlinsongguo — Mon, 22 May 2017 05:51:12 GMT

I found what is the problem
1 as previous mentioned csv file format need to be commas separated.
2 Lookup table basic the search field need to match a field in the event and it is case sensitive, otherwise I need to define which field to match
index=x eventField=* | lookup lookupName lookupTableSearchField AS eventField
that will do the trick
Thank you for all the help

Re: Lookup table does not append value to event

aakwah — Mon, 22 May 2017 10:42:33 GMT

Good news that the issue is solved !

Re: Lookup table does not append value to event

woodcock — Mon, 22 May 2017 19:07:59 GMT

You can make the matching case-insensitive but you need the CLI to add case_sensitive_match = false to transforms.conf.

Don't forget to up-vote helpful answers.