CsvDataProvider - Unable to find filename property for lookup

[kaurinko]

Dear Sirs,

I am using lookup to enrich my event data on the fly, and it seems to work fine. However, every invocation of the function lookup produces a warning to the splunkd.log as follows:

06-04-2020 18:39:27.136 +0300 WARN CsvDataProvider - Unable to find filename property for lookup=splunk-installation-info.csv will attempt to use implicit filename.

The search producing the above is

| rest splunk_server=lic /services/licenser/slaves
| lookup splunk-installation-info.csv splunk_uuid AS title OUTPUT BU    

It works, but I am puzzled by the warning. I would like to get rid of it, so how do I tell Splunk the explicit filename?

Best regards,

Petri

[saravanan90]

I got into the same error...Has there any solution for this issue....

[nmsaraujo]

Can you check what is the character-encoding of that file, directly in the cli with command file -i lookup_name.csv?

In my situation, the encoding type was different from  "text/plain; charset=us-ascii", was in fact "application/octet-stream; charset=binary".

I opened the file in Notepad++, changed encoding to UTF8, loaded the file again to splunk with lookup editor, and it worked.

Let me know if this works for you also.