Getting Data In

"Export results..." output blank when using inputlookup

rtadams89
Contributor

If I perform a search for:

index=myindex | table field1, field2, field3

and then use the "Actions" menu to "Export results", I can get a csv with 3 columns and as many lines as there were events returned by the search.

On the other hand, if I run this search:

| inputlookup test.csv | table field1, field2, field3

and then attempt to "Export results", the output (csv, xml, or json) is always empty (no column headers or data). The test.csv file contains data and the search displays data within the Splunk web GUI, just nothing when attempting to export.

Both of the above search would allow me to export data when I was running 4.2.3; this problem only appears after upgrading to 5.0.4.

Any ideas what the fix is?

1 Solution

rtadams89
Contributor

Looks like there was an issue with the xml views for the search app. The XML views worked in the 4.x line, but when upgraded to 5.x, the xml persisted and had the Export function referencing the events endpoint instead of the results endpoint. I went in an manually deleted the xml files from apps/search/local/data/ui/views and the problem is now fixed.

View solution in original post

rtadams89
Contributor

Looks like there was an issue with the xml views for the search app. The XML views worked in the 4.x line, but when upgraded to 5.x, the xml persisted and had the Export function referencing the events endpoint instead of the results endpoint. I went in an manually deleted the xml files from apps/search/local/data/ui/views and the problem is now fixed.

rtadams89
Contributor

Additional info: It appears this may be a problem with Splunk exporting data when there are no "events" (such as when using the inputlookup command). Again, this has only been happening since the upgrade from the 4.2.x line to the 5.0.x line.

I'm not able to reproduce the issue with a fresh 5.0.4 error, so I assume this is a configuration error. Looking through the logs in _internal I don't see any obvious errors (what should I be looking for for csv export errors?).

0 Karma

rturk
Builder

Hi Rtadams89,

I've just tested in 5.0.1 & 5.0.4 and am unable to replicate the issue you are reporting. The only thing that I can see wrong with what you have described is a missing pipe character at the start of your second command:

| inputlookup test.csv | table field1, field2, field3

rtadams89
Contributor

Sorry, that was a typo in my original post. In my testing, I DO have a leading pipe.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...