Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Getting error when i called a lookup file
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
Can someone hlep me why am getting this error.. and what i had to do to resolve
"Assuming implicit lookup table with filename 'lookup_test.csv'"
Have given search as ../lookup lookup_test.csv locno as locno OUTPUT locname as locname,
have lookup table structure as
locno,locname,zipcode,city
1,abc,1001,HYD
1,def,1002,CHN
am passing locno and want to fetch "locname" and show in report.
Have added this lookup table from Manager->lookup and provided lookup table location..
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Well its not really an error, its telling you that you don't have a definition for that lookup defined so its implicitly assuming you mean the one that its spotted in a lookup directory with the same name.
You can define the lookup in your transforms.conf to remove this notice, e.g.
[lookup_test]
filename = lookup_test.csv
Then you can just use | lookup lookup_test ....
Also, you don't need to do locno as locno, you only need AS if you need to rename the field to match the field names in the lookup, in this case its the same as your Splunk field so you don't need to include AS at all.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Well its not really an error, its telling you that you don't have a definition for that lookup defined so its implicitly assuming you mean the one that its spotted in a lookup directory with the same name.
You can define the lookup in your transforms.conf to remove this notice, e.g.
[lookup_test]
filename = lookup_test.csv
Then you can just use | lookup lookup_test ....
Also, you don't need to do locno as locno, you only need AS if you need to rename the field to match the field names in the lookup, in this case its the same as your Splunk field so you don't need to include AS at all.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
as you suggested added as
[lookup_test.csv]
filename=lookup_test.csv in transforms.conf and now its working fine as i expected..
thanks for your correct sol.
AI for AppInspect
App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community
Operationalizing Entity Risk Score with Enterprise Security 8.3+
