Splunk Search

Empty Lookup Tables - disable warning banner

apgersplunk
New Member

version 6

I maintain a set of csv files as lookup tables and everything works perfectly fine with one exception. If any of the files contain only a header but no data, the views that reference the collection of lookups pastes a yellow warning banner across the UI stating "Empty csv lookup file (contains only a header) for table ...".

Some of the csv files will occasionally be empty by design (header only) and I am trying to figure out how to disable these warnings. Any ideas?

Tags (3)
0 Karma

apgersplunk
New Member

Thanks for the quick reply and good pointer. I tested the logging levels associated with "lookup" and "csv" related channels with no luck. It seems that the handler would have fixed it. I made the test changes through the GUI while troubleshooting.

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi apgersplunk,

you can either set it in log.cfg or in the Manager - System Settings - System logging and change the setting for one of the lookup channels. Available channels are:

  • LookupOperator
  • LookupTableConfPathMapper
  • LookupTablesHandler

hope this helps ...

cheers, MuS

MuS
SplunkTrust
SplunkTrust

another thought just came up my head...you can disable/modify the message bar in the XML of your views as well ..... but, this is dangerzone, because you can set it to be too strict and you will also NOT receive any other message as well (like license violations)

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...