All Apps and Add-ons

Error (code 1) when performing a lookup with DB Connect 2

ctaf
Contributor

Hello,

I added a lookup with DB connect 2 to read a MS-SQL DB containing :
- ID: row id
- Mail: email address
- Country: country of the email address's owner

I use this lookup like this:

| lookup db_connect_lookup_name Mail AS mailto Mail AS mailfrom OUTPUT country

(notice that "country" doesn't have a capitalized C letter because it throws an error:

Error in 'lookup' command: Could not find all of the specified destination fields in the lookup table.

That is strange, because with it is written like this in the DB.)

The command works with an error:

Script for lookup table 'db_connect_lookup_name' returned error code 1. Results may be incorrect.

A lot of the "country" values are not populated.

I check the internal logs, but there is no error.

I just found this event:

2016-02-17 16:37:47 INFO DBX2LookupJDBC:219 - Reload lookup table. The statistics is: Region Name = lookup_name HitCountRam = 18602 HitCountAux = 1503 ---------------------------Memory Cache List Size = 10000 Map Size = 10000 Put Count = 63479 Hit Count = 18899 Miss Count = 11034 ---------------------------Indexed Disk Cache Is Alive = true Key Map Size = 32939 Data File Length = 18440306 Hit Count = 2486 Bytes Free = 123463 Optimize Operation Count = 1128 Times Optimized = 0 Recycle Count = 912 Recycle Bin Size = 216 Startup Size = 0 Purgatory Hits = 38 Purgatory Size = 0 Working = true Alive = true Empty = true Size = 0

Does that mean that the lookup is refreshing the cache with only the first 10000 results?

I am a bit lost here..

Any ideas?

jsilverbears
Path Finder

I have seen this problem too. I could not get the lookup table to get me any more than a set amount of rows. I also did not see anyone in the forums who had a solution to this. I assume there are settings for this but I cannot locate them

What I did was put the data into the input as another column instead of pulling from a lookup table. I only use lookup tables for small sets of translations, usually <1000 rows.

The error code you are seeing is not really an error. It's more of a warning. It's saying that not all the values corresponded to values in the lookup table and therefore the results "may be incorrect".

ctaf
Contributor

Anyone has an idea?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...