Splunk Search

Error in 'lookup' command: The lookup table 'switch_name' does not exist.

laiyongmao
Path Finder

I'm not sure it can, but it is wrong, and I want to know how to solve.

trasforms.conf
[switch_name]
filename = switch_name.csv
[switch_info]
filename = switch_info.csv
[wan_info]
filename = wan.csv

props.conf
[pinginfo]
NO_BINARY_CHECK = 1
pulldown_type = 1
LOOKUP-switch_name = switch_name ip as host OUTPUT locate as name
LOOKUP-switch_info = switch_info host as host
LOOKUP-wan_info = wan_info host as host

Who can tell me how to solve this problem?thanks

Tags (1)
0 Karma
1 Solution

lguinn2
Legend

Assuming that this transforms.conf and props.conf files exist in an app named "myApp", you should find files named

switch_name.csv  
switch_info.csv  
wan.csv

in the directory $SPLUNK_HOME/etc/apps/myApp/lookups
If the files are not there, or cannot be read, you will get this message.

View solution in original post

lguinn2
Legend

Assuming that this transforms.conf and props.conf files exist in an app named "myApp", you should find files named

switch_name.csv  
switch_info.csv  
wan.csv

in the directory $SPLUNK_HOME/etc/apps/myApp/lookups
If the files are not there, or cannot be read, you will get this message.

laiyongmao
Path Finder

yeah,i can see it,but it is not work.

[root@localhost lookups]# ls
switch_info.csv switch_name.csv wan.csv
[root@localhost lookups]# vim switch_info.csv
host,name,int,ip
10.3.15.11_TenGigabitEthernet5-4,A,Ten5-4,10.3.15.11
10.3.15.11_TenGigabitEthernet6-4,A,Ten6-4,10.3.15.11
10.3.15.12_TenGigabitEthernet5-4,B,Ten5-4,10.3.15.12
10.3.15.12_TenGigabitEthernet6-4,B,Ten6-4,10.3.15.12

I tried many methods, can not, I am depressed ah.

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...