All Apps and Add-ons

Error (code 1) when performing a lookup with DB Connect 2

ctaf
Contributor

Hello,

I added a lookup with DB connect 2 to read a MS-SQL DB containing :
- ID: row id
- Mail: email address
- Country: country of the email address's owner

I use this lookup like this:

| lookup db_connect_lookup_name Mail AS mailto Mail AS mailfrom OUTPUT country

(notice that "country" doesn't have a capitalized C letter because it throws an error:

Error in 'lookup' command: Could not find all of the specified destination fields in the lookup table.

That is strange, because with it is written like this in the DB.)

The command works with an error:

Script for lookup table 'db_connect_lookup_name' returned error code 1. Results may be incorrect.

A lot of the "country" values are not populated.

I check the internal logs, but there is no error.

I just found this event:

2016-02-17 16:37:47 INFO DBX2LookupJDBC:219 - Reload lookup table. The statistics is: Region Name = lookup_name HitCountRam = 18602 HitCountAux = 1503 ---------------------------Memory Cache List Size = 10000 Map Size = 10000 Put Count = 63479 Hit Count = 18899 Miss Count = 11034 ---------------------------Indexed Disk Cache Is Alive = true Key Map Size = 32939 Data File Length = 18440306 Hit Count = 2486 Bytes Free = 123463 Optimize Operation Count = 1128 Times Optimized = 0 Recycle Count = 912 Recycle Bin Size = 216 Startup Size = 0 Purgatory Hits = 38 Purgatory Size = 0 Working = true Alive = true Empty = true Size = 0

Does that mean that the lookup is refreshing the cache with only the first 10000 results?

I am a bit lost here..

Any ideas?

jsilverbears
Path Finder

I have seen this problem too. I could not get the lookup table to get me any more than a set amount of rows. I also did not see anyone in the forums who had a solution to this. I assume there are settings for this but I cannot locate them

What I did was put the data into the input as another column instead of pulling from a lookup table. I only use lookup tables for small sets of translations, usually <1000 rows.

The error code you are seeing is not really an error. It's more of a warning. It's saying that not all the values corresponded to values in the lookup table and therefore the results "may be incorrect".

ctaf
Contributor

Anyone has an idea?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...