Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Getting error when i called a lookup file
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
Can someone hlep me why am getting this error.. and what i had to do to resolve
"Assuming implicit lookup table with filename 'lookup_test.csv'"
Have given search as ../lookup lookup_test.csv locno as locno OUTPUT locname as locname,
have lookup table structure as
locno,locname,zipcode,city
1,abc,1001,HYD
1,def,1002,CHN
am passing locno and want to fetch "locname" and show in report.
Have added this lookup table from Manager->lookup and provided lookup table location..
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Well its not really an error, its telling you that you don't have a definition for that lookup defined so its implicitly assuming you mean the one that its spotted in a lookup directory with the same name.
You can define the lookup in your transforms.conf to remove this notice, e.g.
[lookup_test]
filename = lookup_test.csv
Then you can just use | lookup lookup_test ....
Also, you don't need to do locno as locno, you only need AS if you need to rename the field to match the field names in the lookup, in this case its the same as your Splunk field so you don't need to include AS at all.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Well its not really an error, its telling you that you don't have a definition for that lookup defined so its implicitly assuming you mean the one that its spotted in a lookup directory with the same name.
You can define the lookup in your transforms.conf to remove this notice, e.g.
[lookup_test]
filename = lookup_test.csv
Then you can just use | lookup lookup_test ....
Also, you don't need to do locno as locno, you only need AS if you need to rename the field to match the field names in the lookup, in this case its the same as your Splunk field so you don't need to include AS at all.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
as you suggested added as
[lookup_test.csv]
filename=lookup_test.csv in transforms.conf and now its working fine as i expected..
thanks for your correct sol.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
March Forward: A Simpler Way to Stay Splunk Certified
Index This | What travels the world but is also stuck in place?
Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data
