Splunk Dev

Lookup table does not exist . It is referenced by configuration 'yyyy'

florencegoh
New Member

Hi,
When configuring the lookup table, i receive the following error The lookup table 'xxxx' does not exist. It is referenced by configuration 'yyyyy'.
index=main sourcetype=yyyy [|inputlookup xxxx.csv |fields account_name] | chart count(username) by username

The objective of is to find a list of accounts listed in xxxx.csv field and count the number of time the user login from the sourcetype yyyy.

Please advise what could be the error

Tags (1)
0 Karma

493669
Super Champion

Hi florencegoh,
It seems to be permission issue.
so include Below Stanza in metadata>default.meta -

[props/<sourcetype_name>/LOOKUP-<Automatic_Lookup_Name>]
export = none
0 Karma

florencegoh
New Member

Hi,
where do you configure that ? New to it.

Regards,

0 Karma

493669
Super Champion

You can add that stanza in file "default.meta" present inside metadata folder

0 Karma

hardikJsheth
Motivator

Did you check permission of lookup table?? If you fire following query are you getting any output??

|inputlookup xxx.csv

I would suggest that you use lookup command instead of inputlookup, for example

index=main sourcetype=yyyy |lookup xxxx.csv username output  account_name | chart count(username) by username
0 Karma

florencegoh
New Member

Getting the outputs of the table when running "|inputlookup.csv.

I have run that suggested command. but still getting the error as "could not find all the specified lookup fields in the lookup table".

Any suggestion ?

0 Karma

hardikJsheth
Motivator

Can you confirm presence of the column "account_name" in your lookup file which is extracted from lookup file?

0 Karma

493669
Super Champion

IS lookup table 'xxxx' is automatic lookup?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...