Getting Data In

Lookups not working

Path Finder

I am running splunk4.2.2 on Linux servers

On My search-heads under /app/splunk/etc/system/local

props.conf entries


TZ = US/Eastern
REPORT-rsysog = rsyslog_extractions

lookup_deparment = IpLookup log_ip OUTPUT dept_name

transforms.conf entries
REGEX = (\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(.*)
FORMAT = log_date::"$1" time::"$2" log_ip::"$3" log_host::"$4" facility::"$5" seveority::"$6" Message::"$12"
WRITE_META = false

Under /app/splunk/etc/system/lookups

IpLookup.csv entries,nw_grp_SUCCESS,SUCCESS_PENDING

I am still getting The lookup table 'IpLookup' does not exist. It is referenced by configuration 'syslog_vrsn' and Its pointing to Indexers ..I even pushed the same config to Indexers But splunk still says "IpLookup" missining I even copied Iplookup.csv to Iplookup to see If the error clears but No luck ..Any help or any one have this issue ?

0 Karma

Path Finder

I have already checked those and they show properly

0 Karma

Ultra Champion

What are the "sharing permissions" on the objects ?

Can you post an example of the search you are using ?

0 Karma

Ultra Champion

If you log into Splunk Web and browse to :

Manager » Lookups » Lookup table files

Manager » Lookups » Lookup definitions

Do you see the lookup definition and lookup file objects and are the sharing permissions set appropriately ?

0 Karma

Path Finder

Thanks for the reply Damien , I tried the file name explicitly but still complains abt "The lookup table 'IpLookup' does not exist. It is referenced by configuration 'syslog_vrsn' "

0 Karma

Ultra Champion

Try this (note, I corrected your "deparment" spelling)


LOOKUP-department = IpLookup log_ip OUTPUT dept_name



filename = Iplookup.csv
max_matches = 1
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!