I'm not sure it can, but it is wrong, and I want to know how to solve.
filename = switchname.csv
filename = switchinfo.csv
filename = wan.csv
NOBINARYCHECK = 1
pulldowntype = 1
LOOKUP-switchname = switchname ip as host OUTPUT locate as name
LOOKUP-switchinfo = switchinfo host as host
LOOKUP-waninfo = wan_info host as host
Who can tell me how to solve this problem？thanks
Assuming that this transforms.conf and props.conf files exist in an app named "myApp", you should find files named
in the directory $SPLUNK_HOME/etc/apps/myApp/lookups
If the files are not there, or cannot be read, you will get this message.
View solution in original post
yeah,i can see it,but it is not work.
[root@localhost lookups]# ls
switchinfo.csv switchname.csv wan.csv
[root@localhost lookups]# vim switchinfo.csv
I tried many methods, can not, I am depressed ah.