Splunk Search
Highlighted

Error in 'lookup' command: The lookup table 'switch_name' does not exist.

Path Finder

I'm not sure it can, but it is wrong, and I want to know how to solve.

trasforms.conf
[switchname]
filename = switch
name.csv
[switchinfo]
filename = switch
info.csv
[wan_info]
filename = wan.csv

props.conf
[pinginfo]
NOBINARYCHECK = 1
pulldowntype = 1
LOOKUP-switch
name = switchname ip as host OUTPUT locate as name
LOOKUP-switch
info = switchinfo host as host
LOOKUP-wan
info = wan_info host as host

Who can tell me how to solve this problem?thanks

Tags (1)
0 Karma
Highlighted

Re: Error in 'lookup' command: The lookup table 'switch_name' does not exist.

Legend

Assuming that this transforms.conf and props.conf files exist in an app named "myApp", you should find files named

switch_name.csv  
switch_info.csv  
wan.csv

in the directory $SPLUNK_HOME/etc/apps/myApp/lookups
If the files are not there, or cannot be read, you will get this message.

View solution in original post

Highlighted

Re: Error in 'lookup' command: The lookup table 'switch_name' does not exist.

Path Finder

yeah,i can see it,but it is not work.

[root@localhost lookups]# ls
switchinfo.csv switchname.csv wan.csv
[root@localhost lookups]# vim switchinfo.csv
host,name,int,ip
10.3.15.11
TenGigabitEthernet5-4,A,Ten5-4,10.3.15.11
10.3.15.11TenGigabitEthernet6-4,A,Ten6-4,10.3.15.11
10.3.15.12
TenGigabitEthernet5-4,B,Ten5-4,10.3.15.12
10.3.15.12_TenGigabitEthernet6-4,B,Ten6-4,10.3.15.12

I tried many methods, can not, I am depressed ah.

0 Karma