Splunk Search

Getting error when i called a lookup file

pramodkumar
Path Finder

Hi,
Can someone hlep me why am getting this error.. and what i had to do to resolve
"Assuming implicit lookup table with filename 'lookup_test.csv'"
Have given search as ../lookup lookup_test.csv locno as locno OUTPUT locname as locname,
have lookup table structure as
locno,locname,zipcode,city
1,abc,1001,HYD
1,def,1002,CHN
am passing locno and want to fetch "locname" and show in report.
Have added this lookup table from Manager->lookup and provided lookup table location..

Tags (1)
1 Solution

Drainy
Champion

Well its not really an error, its telling you that you don't have a definition for that lookup defined so its implicitly assuming you mean the one that its spotted in a lookup directory with the same name.

You can define the lookup in your transforms.conf to remove this notice, e.g.

[lookup_test]
filename = lookup_test.csv

Then you can just use | lookup lookup_test ....
Also, you don't need to do locno as locno, you only need AS if you need to rename the field to match the field names in the lookup, in this case its the same as your Splunk field so you don't need to include AS at all.

View solution in original post

Drainy
Champion

Well its not really an error, its telling you that you don't have a definition for that lookup defined so its implicitly assuming you mean the one that its spotted in a lookup directory with the same name.

You can define the lookup in your transforms.conf to remove this notice, e.g.

[lookup_test]
filename = lookup_test.csv

Then you can just use | lookup lookup_test ....
Also, you don't need to do locno as locno, you only need AS if you need to rename the field to match the field names in the lookup, in this case its the same as your Splunk field so you don't need to include AS at all.

View solution in original post

pramodkumar
Path Finder

as you suggested added as
[lookup_test.csv]
filename=lookup_test.csv in transforms.conf and now its working fine as i expected..
thanks for your correct sol.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!