Splunk Search

Getting error when i called a lookup file

pramodkumar
Path Finder

Hi,
Can someone hlep me why am getting this error.. and what i had to do to resolve
"Assuming implicit lookup table with filename 'lookup_test.csv'"
Have given search as ../lookup lookup_test.csv locno as locno OUTPUT locname as locname,
have lookup table structure as
locno,locname,zipcode,city
1,abc,1001,HYD
1,def,1002,CHN
am passing locno and want to fetch "locname" and show in report.
Have added this lookup table from Manager->lookup and provided lookup table location..

Tags (1)
1 Solution

Drainy
Champion

Well its not really an error, its telling you that you don't have a definition for that lookup defined so its implicitly assuming you mean the one that its spotted in a lookup directory with the same name.

You can define the lookup in your transforms.conf to remove this notice, e.g.

[lookup_test]
filename = lookup_test.csv

Then you can just use | lookup lookup_test ....
Also, you don't need to do locno as locno, you only need AS if you need to rename the field to match the field names in the lookup, in this case its the same as your Splunk field so you don't need to include AS at all.

View solution in original post

Drainy
Champion

Well its not really an error, its telling you that you don't have a definition for that lookup defined so its implicitly assuming you mean the one that its spotted in a lookup directory with the same name.

You can define the lookup in your transforms.conf to remove this notice, e.g.

[lookup_test]
filename = lookup_test.csv

Then you can just use | lookup lookup_test ....
Also, you don't need to do locno as locno, you only need AS if you need to rename the field to match the field names in the lookup, in this case its the same as your Splunk field so you don't need to include AS at all.

pramodkumar
Path Finder

as you suggested added as
[lookup_test.csv]
filename=lookup_test.csv in transforms.conf and now its working fine as i expected..
thanks for your correct sol.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...