Splunk Enterprise Security

Error in 'lookup' command: Could not construct lookup

mansourireza
Explorer

I have the following scheduled search that updates a lookup (simple_identity_lookup) by adding new entries that aren't already in it.

| datamodel Identity_Management "All_Identities" search 
| `drop_dm_object_name(All_Identities)`
| lookup simple_identity_lookup EmpNo OUTPUT EmpNo AS temp
| where isnull(temp) 
| rename LoginID AS identity, NickName AS nick, FirstName AS first, LastName AS last, Email AS email, Phone AS phone, SupName AS managedBy, DeptName AS bunit, JobTitle AS category, ST AS work_location, Status as status
| table identity, prefix, nick, first, last, suffix, email, phone, managedBy, priority, bunit, category, watchlist, startDate, endDate, EmpNo, work_location, work_country, status
| outputlookup append=true simple_identity_lookup

The search is failing with following error:

Streamed search execute failed because: Error in 'lookup' command: Could not construct lookup 'simple_identity_lookup, EmpNo, OUTPUT, EmpNo, AS, temp'. See search.log for more details.

Looking in the search.log of this search for any errors yielded the following:

03-31-2020 13:44:26.466 WARN  SearchOperator:kv - Regex 'ISQ:.*?(?:[Rr]eleased|[Rr]eleasing) MID' has no capturing groups, transform_name='fields_for_cisco_esa_released'.
03-31-2020 13:44:26.466 WARN  SearchOperator:kv - No valid key names found in FORMAT for transform_name='fields_for_cisco_esa_released'.
03-31-2020 13:44:26.466 WARN  SearchOperator:kv - Invalid key-value parser, ignoring it, transform_name='fields_for_cisco_esa_released'.
03-31-2020 13:44:26.467 WARN  SearchOperator:kv - Regex '(?:ISQ:.*?[Qq]uarantine)' has no capturing groups, transform_name='fields_for_cisco_esa_quarantine'.
03-31-2020 13:44:26.467 WARN  SearchOperator:kv - No valid key names found in FORMAT for transform_name='fields_for_cisco_esa_quarantine'.
03-31-2020 13:44:26.467 WARN  SearchOperator:kv - Invalid key-value parser, ignoring it, transform_name='fields_for_cisco_esa_quarantine'.
03-31-2020 13:44:26.784 WARN  SearchOperator:kv - Invalid key-value parser, ignoring it, transform_name='link_kv_for_ueba'.
03-31-2020 13:44:26.848 ERROR SearchOperator:kv - Cannot compile RE \"(?:\s*'[^']*'|\s*"[^"]*"|\s*[^,]*)\s*(?<Server_Name>[^,']*'[^']*'|[^,"]*"[^"]*"|[^,]*)\s*(?<Domain>[^,']*'[^']*'|[^,"]*"[^"]*"|[^,]*),\s*(?<Server_Name>[^,']*'[^']*'|[^,"]*"[^"]*"|[^,]*),\s*(?<Event_Description>[^,']*'[^']*'|[^,"]*"[^"]*"|[^,]*)\" for transform 'field_extraction_for_scm_system': Regex: two named subpatterns have the same name (PCRE2_DUPNAMES not set).
03-31-2020 13:44:26.848 WARN  SearchOperator:kv - Invalid key-value parser, ignoring it, transform_name='field_extraction_for_scm_system'.

I am not sure if this is related to search error.

I don't know what's causing the error. The lookup itself works, if I do

| inputlookup simple_identity_lookup

It can pull it up with no errors.

If I remove the OUTPUT portion so it's just

| lookup simple_identity_lookup EmpNo

the same error appears:

Streamed search execute failed because: Error in 'lookup' command: Could not construct lookup 'simple_identity_lookup, EmpNo'. See search.log for more details.

to4kawa
Ultra Champion

Is there EmpNo field?

0 Karma

mansourireza
Explorer

Yes, the field exists in both the lookup and the datamodel

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...