Getting Data In

inputlookup not working from CLI search, but works from GUI on deployment server?

joesrepsol
Path Finder

So I'm trying to setup a search that returns the hostname of the missing forwarders to use in a BladeLogic automation job. To do so we generally run a CLI search, and use the returned rows to run a job against. Sounds easy enough.

I go into the monitoring console section, look at the forwarder deployment, and select the "missing" status link and get the query. I can filter that down to just the forwarders that are missing. Works in the GUI just fine. But when I try this from the CLI (on the same host), then query fails with this strange message.

$ /opt/splunk/bin/splunk search "| inputlookup dmc_forwarder_assets | search status=missing"
WARN: The lookup table 'dmc_forwarder_assets' is invalid.
$

Help? Anyone? Driving me c-r-a-z-y!!!

Running Splunk Enterprise v7.1

Tags (2)
0 Karma

joesrepsol
Path Finder

appears to be global. CLI based search still not working. Am I missing something?

alt text

0 Karma

somesoni2
Revered Legend

What's the sharing permission of the lookup table file/lookup definition dmc_forwarder_assets. If it's not global then you need to include the app under which the looukp is created in the -app parameter in your CLI search.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...