Splunk Search

CsvDataProvider - Unable to find filename property for lookup


Dear Sirs,

I am using lookup to enrich my event data on the fly, and it seems to work fine. However, every invocation of the function lookup produces a warning to the splunkd.log as follows:

06-04-2020 18:39:27.136 +0300 WARN CsvDataProvider - Unable to find filename property for lookup=splunk-installation-info.csv will attempt to use implicit filename.

The search producing the above is

| rest splunk_server=lic /services/licenser/slaves
| lookup splunk-installation-info.csv splunk_uuid AS title OUTPUT BU    

It works, but I am puzzled by the warning. I would like to get rid of it, so how do I tell Splunk the explicit filename?

Best regards,


Labels (1)
0 Karma


I got into the same error...Has there any solution for this issue....

0 Karma


Can you check what is the character-encoding of that file, directly in the cli with command file -i lookup_name.csv?

In my situation, the encoding type was different from  "text/plain; charset=us-ascii", was in fact "application/octet-stream; charset=binary".

I opened the file in Notepad++, changed encoding to UTF8, loaded the file again to splunk with lookup editor, and it worked.


Let me know if this works for you also.

Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...