Knowledge Management

Getting errors when using outputlookup

bigchungusfan55
New Member

I am having issues trying to outputlookup to a new empty KV Store lookup table I made. When I try to run the following search, I get this error: 

Error in 'outputlookup' command: Lookup failed because collection '<collection>' in app 'SplunkEnterpriseSecuritySuite' does not exist, or user '<username>' does not have read access.

| makeresults
| eval <field_1>="test"
| eval <field_2>="test"
| eval <field_3>="test"
| eval <field_4>="test"
| fields - _time
| outputlookup <collection>

I redacted the actual data I am using, but it is formatted the same way as above. My KV Store file has global sharing and everyone can read/write, for testing purposes.

What is wrong here and what can I do to fix this?

Labels (1)
Tags (1)
0 Karma

thahir
Communicator

Hi @bigchungusfan55 ,

Please do the following check to find and fix the issue

1. check and confirm that the KV store collection exists

2. Check where the KV Store Lookup is defined

3. Check the permission for the lookup

4. check lookup defintion and collection configuration.

0 Karma

livehybrid
Ultra Champion

Hi @bigchungusfan55 

Have you created the actual collections.conf collection stanza as well as creating the lookup definition?

It sounds like either the name in the definition of the lookup (which is where you match then name you use after outputlookup/inputlookup/lookup) is incorrect, or the collection itself does not exist.

Please can you review this and let us know?

:glowing_star: Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Did you put <collection> in a collections.conf file, distribute it to all SHs, and restart Splunk?  Make sure the collections.conf file defines each field you want to use.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...