Splunk Enterprise Security

Error in 'lookup' command: Could not construct lookup

mansourireza
Explorer

I have the following scheduled search that updates a lookup (simple_identity_lookup) by adding new entries that aren't already in it.

| datamodel Identity_Management "All_Identities" search 
| `drop_dm_object_name(All_Identities)`
| lookup simple_identity_lookup EmpNo OUTPUT EmpNo AS temp
| where isnull(temp) 
| rename LoginID AS identity, NickName AS nick, FirstName AS first, LastName AS last, Email AS email, Phone AS phone, SupName AS managedBy, DeptName AS bunit, JobTitle AS category, ST AS work_location, Status as status
| table identity, prefix, nick, first, last, suffix, email, phone, managedBy, priority, bunit, category, watchlist, startDate, endDate, EmpNo, work_location, work_country, status
| outputlookup append=true simple_identity_lookup

The search is failing with following error:

Streamed search execute failed because: Error in 'lookup' command: Could not construct lookup 'simple_identity_lookup, EmpNo, OUTPUT, EmpNo, AS, temp'. See search.log for more details.

Looking in the search.log of this search for any errors yielded the following:

03-31-2020 13:44:26.466 WARN  SearchOperator:kv - Regex 'ISQ:.*?(?:[Rr]eleased|[Rr]eleasing) MID' has no capturing groups, transform_name='fields_for_cisco_esa_released'.
03-31-2020 13:44:26.466 WARN  SearchOperator:kv - No valid key names found in FORMAT for transform_name='fields_for_cisco_esa_released'.
03-31-2020 13:44:26.466 WARN  SearchOperator:kv - Invalid key-value parser, ignoring it, transform_name='fields_for_cisco_esa_released'.
03-31-2020 13:44:26.467 WARN  SearchOperator:kv - Regex '(?:ISQ:.*?[Qq]uarantine)' has no capturing groups, transform_name='fields_for_cisco_esa_quarantine'.
03-31-2020 13:44:26.467 WARN  SearchOperator:kv - No valid key names found in FORMAT for transform_name='fields_for_cisco_esa_quarantine'.
03-31-2020 13:44:26.467 WARN  SearchOperator:kv - Invalid key-value parser, ignoring it, transform_name='fields_for_cisco_esa_quarantine'.
03-31-2020 13:44:26.784 WARN  SearchOperator:kv - Invalid key-value parser, ignoring it, transform_name='link_kv_for_ueba'.
03-31-2020 13:44:26.848 ERROR SearchOperator:kv - Cannot compile RE \"(?:\s*'[^']*'|\s*"[^"]*"|\s*[^,]*)\s*(?<Server_Name>[^,']*'[^']*'|[^,"]*"[^"]*"|[^,]*)\s*(?<Domain>[^,']*'[^']*'|[^,"]*"[^"]*"|[^,]*),\s*(?<Server_Name>[^,']*'[^']*'|[^,"]*"[^"]*"|[^,]*),\s*(?<Event_Description>[^,']*'[^']*'|[^,"]*"[^"]*"|[^,]*)\" for transform 'field_extraction_for_scm_system': Regex: two named subpatterns have the same name (PCRE2_DUPNAMES not set).
03-31-2020 13:44:26.848 WARN  SearchOperator:kv - Invalid key-value parser, ignoring it, transform_name='field_extraction_for_scm_system'.

I am not sure if this is related to search error.

I don't know what's causing the error. The lookup itself works, if I do

| inputlookup simple_identity_lookup

It can pull it up with no errors.

If I remove the OUTPUT portion so it's just

| lookup simple_identity_lookup EmpNo

the same error appears:

Streamed search execute failed because: Error in 'lookup' command: Could not construct lookup 'simple_identity_lookup, EmpNo'. See search.log for more details.

to4kawa
Ultra Champion

Is there EmpNo field?

0 Karma

mansourireza
Explorer

Yes, the field exists in both the lookup and the datamodel

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...