Splunk Enterprise Security

Error in 'lookup' command: Could not construct lookup

mansourireza
Explorer

I have the following scheduled search that updates a lookup (simple_identity_lookup) by adding new entries that aren't already in it.

| datamodel Identity_Management "All_Identities" search 
| `drop_dm_object_name(All_Identities)`
| lookup simple_identity_lookup EmpNo OUTPUT EmpNo AS temp
| where isnull(temp) 
| rename LoginID AS identity, NickName AS nick, FirstName AS first, LastName AS last, Email AS email, Phone AS phone, SupName AS managedBy, DeptName AS bunit, JobTitle AS category, ST AS work_location, Status as status
| table identity, prefix, nick, first, last, suffix, email, phone, managedBy, priority, bunit, category, watchlist, startDate, endDate, EmpNo, work_location, work_country, status
| outputlookup append=true simple_identity_lookup

The search is failing with following error:

Streamed search execute failed because: Error in 'lookup' command: Could not construct lookup 'simple_identity_lookup, EmpNo, OUTPUT, EmpNo, AS, temp'. See search.log for more details.

Looking in the search.log of this search for any errors yielded the following:

03-31-2020 13:44:26.466 WARN  SearchOperator:kv - Regex 'ISQ:.*?(?:[Rr]eleased|[Rr]eleasing) MID' has no capturing groups, transform_name='fields_for_cisco_esa_released'.
03-31-2020 13:44:26.466 WARN  SearchOperator:kv - No valid key names found in FORMAT for transform_name='fields_for_cisco_esa_released'.
03-31-2020 13:44:26.466 WARN  SearchOperator:kv - Invalid key-value parser, ignoring it, transform_name='fields_for_cisco_esa_released'.
03-31-2020 13:44:26.467 WARN  SearchOperator:kv - Regex '(?:ISQ:.*?[Qq]uarantine)' has no capturing groups, transform_name='fields_for_cisco_esa_quarantine'.
03-31-2020 13:44:26.467 WARN  SearchOperator:kv - No valid key names found in FORMAT for transform_name='fields_for_cisco_esa_quarantine'.
03-31-2020 13:44:26.467 WARN  SearchOperator:kv - Invalid key-value parser, ignoring it, transform_name='fields_for_cisco_esa_quarantine'.
03-31-2020 13:44:26.784 WARN  SearchOperator:kv - Invalid key-value parser, ignoring it, transform_name='link_kv_for_ueba'.
03-31-2020 13:44:26.848 ERROR SearchOperator:kv - Cannot compile RE \"(?:\s*'[^']*'|\s*"[^"]*"|\s*[^,]*)\s*(?<Server_Name>[^,']*'[^']*'|[^,"]*"[^"]*"|[^,]*)\s*(?<Domain>[^,']*'[^']*'|[^,"]*"[^"]*"|[^,]*),\s*(?<Server_Name>[^,']*'[^']*'|[^,"]*"[^"]*"|[^,]*),\s*(?<Event_Description>[^,']*'[^']*'|[^,"]*"[^"]*"|[^,]*)\" for transform 'field_extraction_for_scm_system': Regex: two named subpatterns have the same name (PCRE2_DUPNAMES not set).
03-31-2020 13:44:26.848 WARN  SearchOperator:kv - Invalid key-value parser, ignoring it, transform_name='field_extraction_for_scm_system'.

I am not sure if this is related to search error.

I don't know what's causing the error. The lookup itself works, if I do

| inputlookup simple_identity_lookup

It can pull it up with no errors.

If I remove the OUTPUT portion so it's just

| lookup simple_identity_lookup EmpNo

the same error appears:

Streamed search execute failed because: Error in 'lookup' command: Could not construct lookup 'simple_identity_lookup, EmpNo'. See search.log for more details.

to4kawa
Ultra Champion

Is there EmpNo field?

0 Karma

mansourireza
Explorer

Yes, the field exists in both the lookup and the datamodel

0 Karma
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...