I've followed http://docs.splunk.com/Documentation/Splunk/latest/User/CreateAndConfigureFieldLookups and looked at plenty of questions about the same topic on here and I still can't figure out what I'm doing wrong with my automatic lookup. I also watched a video on this but it didn't really show how the lookup was created.
Here's my csv file I want to use for a file based lookup:
For Lookup Table Files I selected
this csv and gave it the same name
for Destination filename.
For Lookup Definitions, destination app is "search", name is "WAT_Lookups.csv", type is "file based", and the lookup file is "Error_Desc.csv".
For Automatic Lookups, I have the following
Lookup Table: Error_Desc)=
Lookup input fields - ErrorCode=ABCD.ReturnCode
Lookup Output fields - Description = Description
Apply to : sourcetype named ****
Query I used to search is index=*** sourcetype=*** |table ErrorCode Description. If I run this query I get the coulmns but black table. Not sure how to proceed.
Fine. I will correct that. Please clarify me the following.
Lookup Table: Error_Desc
Lookup input fields - ErrorCode=ABCD.ReturnCode (or) ErrorCode (or) ReturnCode
Lookup Output fields - Description = Description "Do I have to make any modifications in this"
Apply to: sourcetype named