Splunk Dev

Lookup table does not exist . It is referenced by configuration 'yyyy'

florencegoh
New Member

Hi,
When configuring the lookup table, i receive the following error The lookup table 'xxxx' does not exist. It is referenced by configuration 'yyyyy'.
index=main sourcetype=yyyy [|inputlookup xxxx.csv |fields account_name] | chart count(username) by username

The objective of is to find a list of accounts listed in xxxx.csv field and count the number of time the user login from the sourcetype yyyy.

Please advise what could be the error

Tags (1)
0 Karma

493669
Super Champion

Hi florencegoh,
It seems to be permission issue.
so include Below Stanza in metadata>default.meta -

[props/<sourcetype_name>/LOOKUP-<Automatic_Lookup_Name>]
export = none
0 Karma

florencegoh
New Member

Hi,
where do you configure that ? New to it.

Regards,

0 Karma

493669
Super Champion

You can add that stanza in file "default.meta" present inside metadata folder

0 Karma

hardikJsheth
Motivator

Did you check permission of lookup table?? If you fire following query are you getting any output??

|inputlookup xxx.csv

I would suggest that you use lookup command instead of inputlookup, for example

index=main sourcetype=yyyy |lookup xxxx.csv username output  account_name | chart count(username) by username
0 Karma

florencegoh
New Member

Getting the outputs of the table when running "|inputlookup.csv.

I have run that suggested command. but still getting the error as "could not find all the specified lookup fields in the lookup table".

Any suggestion ?

0 Karma

hardikJsheth
Motivator

Can you confirm presence of the column "account_name" in your lookup file which is extracted from lookup file?

0 Karma

493669
Super Champion

IS lookup table 'xxxx' is automatic lookup?

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...