Splunk Search

Inputlookup subsearch shows invalid lookup

mdsnmss
SplunkTrust
SplunkTrust

I have a user who is receiving the error:

No matching fields exist [subsearch]: The lookup table <-lookup>.csv is invalid.

This is the result of the line: | JOIN <field> [inputlookup <lookup>.csv]

The search itself runs successfully with multiple other accounts so I am assuming it is a permissions issue. I have gone into the lookup table and definition and both are shared globally and have the user listed with read access. I've also confirmed the field referenced in the join is in both the lookup table and definition.

Any idea why it is not allowing this user to run the search?

0 Karma
1 Solution

mdsnmss
SplunkTrust
SplunkTrust

Kept troubleshooting and it was a permissions issue. The account needed access to the index, the lookup table, and the app the lookup table was in. We had the first two and with the lookup table shared globally and permissions granted to the user for read access to it thought it should work outside of the app context. Adding read access to the app it was contained in allowed the search to run.

View solution in original post

mdsnmss
SplunkTrust
SplunkTrust

Kept troubleshooting and it was a permissions issue. The account needed access to the index, the lookup table, and the app the lookup table was in. We had the first two and with the lookup table shared globally and permissions granted to the user for read access to it thought it should work outside of the app context. Adding read access to the app it was contained in allowed the search to run.

sbbadri
Motivator

try below

| JOIN [|inputlookup .csv]

i think your are missing pipe in fornt of inputlookup

0 Karma

mdsnmss
SplunkTrust
SplunkTrust

It works with or without the pipe for my account.

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...