Splunk Look up Definitions

[keerthana_Reddy]

Hello,

I have created a splunk look up table file( file is in csv format )and now Iam trying to create a look up definition. 

But i couldn't create lookup definition because when i tried searching for the look up file , i couldn't get that file in my drop down menu to select.

what could be the reason. can anyone help with this 

Thanks in advance

[bowesmana]

How did you create the lookup

• by uploading a CSV
• using  the lookup editor
• using outputlookup

which app did you create the lookup in and what app are you in when trying to make the lookup definition.

If yo go to the list of lookup files (Lookups->Lookup table files) can you see the lookup there and what are its permissions - make sure you look for all lookups visible in all apps - and check what app your lookup file is in

[keerthana_Reddy]

Hii Bowesmana, Thanks for your reply

I created the look up table file by uploading the csv file. 

and iam looking in the same app as the one that i created the look up table.

I am actually supposed to get the data from production splunk. so i have very limited access.

The look up table file i created has private access which is visible only to me . would that be an issue ?

[bowesmana]

A private lookup created in App A can ONLY be seen in app A, so if you try to create the lookup definition in app B, then it will not show the CSV in the dropdown 

If your lookup is listed like the above, your  username (red) and app (blue), then I believe it should be possible to create a definition in the same app for a private lookup - so if you cannot see your lookup in the dropdown, it may be a result of permissions - I am not sure, but if you can change your lookup permissions to app, you could see if that changes it.