Splunk Dev

Lookup table does not exist . It is referenced by configuration 'yyyy'

florencegoh
New Member

Hi,
When configuring the lookup table, i receive the following error The lookup table 'xxxx' does not exist. It is referenced by configuration 'yyyyy'.
index=main sourcetype=yyyy [|inputlookup xxxx.csv |fields account_name] | chart count(username) by username

The objective of is to find a list of accounts listed in xxxx.csv field and count the number of time the user login from the sourcetype yyyy.

Please advise what could be the error

Tags (1)
0 Karma

493669
Super Champion

Hi florencegoh,
It seems to be permission issue.
so include Below Stanza in metadata>default.meta -

[props/<sourcetype_name>/LOOKUP-<Automatic_Lookup_Name>]
export = none
0 Karma

florencegoh
New Member

Hi,
where do you configure that ? New to it.

Regards,

0 Karma

493669
Super Champion

You can add that stanza in file "default.meta" present inside metadata folder

0 Karma

hardikJsheth
Motivator

Did you check permission of lookup table?? If you fire following query are you getting any output??

|inputlookup xxx.csv

I would suggest that you use lookup command instead of inputlookup, for example

index=main sourcetype=yyyy |lookup xxxx.csv username output  account_name | chart count(username) by username
0 Karma

florencegoh
New Member

Getting the outputs of the table when running "|inputlookup.csv.

I have run that suggested command. but still getting the error as "could not find all the specified lookup fields in the lookup table".

Any suggestion ?

0 Karma

hardikJsheth
Motivator

Can you confirm presence of the column "account_name" in your lookup file which is extracted from lookup file?

0 Karma

493669
Super Champion

IS lookup table 'xxxx' is automatic lookup?

0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...