Splunk Search

CsvDataProvider - Unable to find filename property for lookup

kaurinko
Communicator

Dear Sirs,

I am using lookup to enrich my event data on the fly, and it seems to work fine. However, every invocation of the function lookup produces a warning to the splunkd.log as follows:

06-04-2020 18:39:27.136 +0300 WARN CsvDataProvider - Unable to find filename property for lookup=splunk-installation-info.csv will attempt to use implicit filename.

The search producing the above is

| rest splunk_server=lic /services/licenser/slaves
| lookup splunk-installation-info.csv splunk_uuid AS title OUTPUT BU    

It works, but I am puzzled by the warning. I would like to get rid of it, so how do I tell Splunk the explicit filename?

Best regards,

Petri

Labels (1)
0 Karma

saravanan90
Contributor

I got into the same error...Has there any solution for this issue....

0 Karma

nmsaraujo
Explorer

Can you check what is the character-encoding of that file, directly in the cli with command file -i lookup_name.csv?

In my situation, the encoding type was different from  "text/plain; charset=us-ascii", was in fact "application/octet-stream; charset=binary".

I opened the file in Notepad++, changed encoding to UTF8, loaded the file again to splunk with lookup editor, and it worked.

 

Let me know if this works for you also.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...