All Apps and Add-ons

Lookup table suddenly showing no data rows

Tbundy
New Member
One of my new colleagues was working on a lookup in a splunk app and seems to have somehow made a lookup table unavailable. His task involved creating and uploading a lookup csv, creating a lookup definition and creating an automatic lookup. No one else has been modifying this Splunk App.

An existing lookup started no longer populating in a dashboard. I looked at the “datasets” and the lookup csv exists and shows a last modified date from way before this issue started, but no rows display when I click on it.

I’m at a loss for what could have caused this or how to fix this. It seems the data still exists, as the modified date hasn’t changed, but somehow has become inaccessible.

 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Tbundy,

Are you suing Lookup editor or are you speaking of |inputlookup command?

Then, admins can display the lookup?

Anyway, check the grants of your lookup, lookup definition and automatic lookup.

Ciao.

Giuseppe

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!