Getting Data In

"Export results..." output blank when using inputlookup

rtadams89
Contributor

If I perform a search for:

index=myindex | table field1, field2, field3

and then use the "Actions" menu to "Export results", I can get a csv with 3 columns and as many lines as there were events returned by the search.

On the other hand, if I run this search:

| inputlookup test.csv | table field1, field2, field3

and then attempt to "Export results", the output (csv, xml, or json) is always empty (no column headers or data). The test.csv file contains data and the search displays data within the Splunk web GUI, just nothing when attempting to export.

Both of the above search would allow me to export data when I was running 4.2.3; this problem only appears after upgrading to 5.0.4.

Any ideas what the fix is?

1 Solution

rtadams89
Contributor

Looks like there was an issue with the xml views for the search app. The XML views worked in the 4.x line, but when upgraded to 5.x, the xml persisted and had the Export function referencing the events endpoint instead of the results endpoint. I went in an manually deleted the xml files from apps/search/local/data/ui/views and the problem is now fixed.

View solution in original post

rtadams89
Contributor

Looks like there was an issue with the xml views for the search app. The XML views worked in the 4.x line, but when upgraded to 5.x, the xml persisted and had the Export function referencing the events endpoint instead of the results endpoint. I went in an manually deleted the xml files from apps/search/local/data/ui/views and the problem is now fixed.

rtadams89
Contributor

Additional info: It appears this may be a problem with Splunk exporting data when there are no "events" (such as when using the inputlookup command). Again, this has only been happening since the upgrade from the 4.2.x line to the 5.0.x line.

I'm not able to reproduce the issue with a fresh 5.0.4 error, so I assume this is a configuration error. Looking through the logs in _internal I don't see any obvious errors (what should I be looking for for csv export errors?).

0 Karma

rturk
Builder

Hi Rtadams89,

I've just tested in 5.0.1 & 5.0.4 and am unable to replicate the issue you are reporting. The only thing that I can see wrong with what you have described is a missing pipe character at the start of your second command:

| inputlookup test.csv | table field1, field2, field3

rtadams89
Contributor

Sorry, that was a typo in my original post. In my testing, I DO have a leading pipe.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...