Lookup Tables Not functioning

[ltrand]

I looked at Splunk Answer and saw that there is a known issue that is reported as a false-positive. However, I do not believe that to be the case.

It looks like lookup tables that are a part of a prebuilt app are working correctly, however lookup tables that are manually inputted to the search app are not currently working. We're using multiple search heads with a common NFS where the apps are deployed to. Using a seperate deployment server to manage everything except the search app.

I can't find anywere that identifies specifically why the errors in the above mentioned link are generated, however attempting to do a inputlookup to read the contents of the lookups does generate the referenced errors, so I'm inclined to believe it is either not related or that the above bug report is not a false-positive logging event.

Has anyone seen similar results? Do you show null returns for lookups in which you get a lookup error in your logs?

[ltrand]

I figured out the issue I was having. If only doing a input it MUST be structured as such:

| inputlookup some.csv

Absense of the leading | will break the search but no syntax error will be given.

[neelamssantosh]

Kindly check if ur lookup is is being read by Splunk using
/opt/Splunk/bin/splunk btool lookups list --debug

Also make the lookups to global/permissions.

In some scenarios once lookups are in place do /debug/refresh or restart.

Hope it can help u.