Splunk Search

Inputlookup subsearch shows invalid lookup

mdsnmss
SplunkTrust
SplunkTrust

I have a user who is receiving the error:

No matching fields exist [subsearch]: The lookup table <-lookup>.csv is invalid.

This is the result of the line: | JOIN <field> [inputlookup <lookup>.csv]

The search itself runs successfully with multiple other accounts so I am assuming it is a permissions issue. I have gone into the lookup table and definition and both are shared globally and have the user listed with read access. I've also confirmed the field referenced in the join is in both the lookup table and definition.

Any idea why it is not allowing this user to run the search?

0 Karma
1 Solution

mdsnmss
SplunkTrust
SplunkTrust

Kept troubleshooting and it was a permissions issue. The account needed access to the index, the lookup table, and the app the lookup table was in. We had the first two and with the lookup table shared globally and permissions granted to the user for read access to it thought it should work outside of the app context. Adding read access to the app it was contained in allowed the search to run.

View solution in original post

mdsnmss
SplunkTrust
SplunkTrust

Kept troubleshooting and it was a permissions issue. The account needed access to the index, the lookup table, and the app the lookup table was in. We had the first two and with the lookup table shared globally and permissions granted to the user for read access to it thought it should work outside of the app context. Adding read access to the app it was contained in allowed the search to run.

sbbadri
Motivator

try below

| JOIN [|inputlookup .csv]

i think your are missing pipe in fornt of inputlookup

0 Karma

mdsnmss
SplunkTrust
SplunkTrust

It works with or without the pipe for my account.

0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...