Splunk Search

Error in 'lookup' command: The lookup table 'switch_name' does not exist.

laiyongmao
Path Finder

I'm not sure it can, but it is wrong, and I want to know how to solve.

trasforms.conf
[switch_name]
filename = switch_name.csv
[switch_info]
filename = switch_info.csv
[wan_info]
filename = wan.csv

props.conf
[pinginfo]
NO_BINARY_CHECK = 1
pulldown_type = 1
LOOKUP-switch_name = switch_name ip as host OUTPUT locate as name
LOOKUP-switch_info = switch_info host as host
LOOKUP-wan_info = wan_info host as host

Who can tell me how to solve this problem?thanks

Tags (1)
0 Karma
1 Solution

lguinn2
Legend

Assuming that this transforms.conf and props.conf files exist in an app named "myApp", you should find files named

switch_name.csv  
switch_info.csv  
wan.csv

in the directory $SPLUNK_HOME/etc/apps/myApp/lookups
If the files are not there, or cannot be read, you will get this message.

View solution in original post

lguinn2
Legend

Assuming that this transforms.conf and props.conf files exist in an app named "myApp", you should find files named

switch_name.csv  
switch_info.csv  
wan.csv

in the directory $SPLUNK_HOME/etc/apps/myApp/lookups
If the files are not there, or cannot be read, you will get this message.

laiyongmao
Path Finder

yeah,i can see it,but it is not work.

[root@localhost lookups]# ls
switch_info.csv switch_name.csv wan.csv
[root@localhost lookups]# vim switch_info.csv
host,name,int,ip
10.3.15.11_TenGigabitEthernet5-4,A,Ten5-4,10.3.15.11
10.3.15.11_TenGigabitEthernet6-4,A,Ten6-4,10.3.15.11
10.3.15.12_TenGigabitEthernet5-4,B,Ten5-4,10.3.15.12
10.3.15.12_TenGigabitEthernet6-4,B,Ten6-4,10.3.15.12

I tried many methods, can not, I am depressed ah.

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...