Solved: An update was made to the identities.csv and now I... - Splunk Community

Getting Data In

If I run:

| inputlookup identities.csv

xxxx results

That shows a different count in the results than

| datamodel("Identity_Management", "All_Identities")

yyyy results

What is going on? I thought I built my indentities.csv correctly.

1 Solution

Solution

Take a look at the python_modular_input.log file. This will give you clues as to what is happening. In this case, a field called _time was created and that is not allowed. I saw this error message:

ERROR pid=7888 tid=identity file=lookup_modinput.py:streaming_merge_task:283 | status="Exception when reading input files" exc=Field names cannot start with an underscore: '_time'

Once the field was corrected to not start with an underscore, things worked fine.

View solution in original post

Solution

Take a look at the python_modular_input.log file. This will give you clues as to what is happening. In this case, a field called _time was created and that is not allowed. I saw this error message:

ERROR pid=7888 tid=identity file=lookup_modinput.py:streaming_merge_task:283 | status="Exception when reading input files" exc=Field names cannot start with an underscore: '_time'

Once the field was corrected to not start with an underscore, things worked fine.

Get Updates on the Splunk Community!

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...