Getting errors when using outputlookup

[bigchungusfan55]

I am having issues trying to outputlookup to a new empty KV Store lookup table I made. When I try to run the following search, I get this error: 

Error in 'outputlookup' command: Lookup failed because collection '<collection>' in app 'SplunkEnterpriseSecuritySuite' does not exist, or user '<username>' does not have read access.

| makeresults
| eval <field_1>="test"
| eval <field_2>="test"
| eval <field_3>="test"
| eval <field_4>="test"
| fields - _time
| outputlookup <collection>

I redacted the actual data I am using, but it is formatted the same way as above. My KV Store file has global sharing and everyone can read/write, for testing purposes.

What is wrong here and what can I do to fix this?

[bigchungusfan55 · Accepted solution]

It seems that the collections.conf was not properly configured when I made the collection. I was under the assumption that the Splunk app for lookup file editing created a completed collections.conf when creating a lookup table using the tool (this was my first time trying it for this purpose). I have fixed the configuration file and successfully resolved the issue.

[PickleRick]

Adding to what's already been said - are you sure you're in the same app context as you created your collection in?

[thahir]

Hi @bigchungusfan55 ,

Please do the following check to find and fix the issue

1. check and confirm that the KV store collection exists

2. Check where the KV Store Lookup is defined

3. Check the permission for the lookup

4. check lookup defintion and collection configuration.

[livehybrid]

Hi @bigchungusfan55 

Have you created the actual collections.conf collection stanza as well as creating the lookup definition?

It sounds like either the name in the definition of the lookup (which is where you match then name you use after outputlookup/inputlookup/lookup) is incorrect, or the collection itself does not exist.

Please can you review this and let us know?

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[richgalloway]

Did you put <collection> in a collections.conf file, distribute it to all SHs, and restart Splunk?  Make sure the collections.conf file defines each field you want to use.

[HiramMann]

I’m thinking that this might be the same issue.