Splunk Search

Inputlookup subsearch shows invalid lookup

mdsnmss
SplunkTrust
SplunkTrust

I have a user who is receiving the error:

No matching fields exist [subsearch]: The lookup table <-lookup>.csv is invalid.

This is the result of the line: | JOIN <field> [inputlookup <lookup>.csv]

The search itself runs successfully with multiple other accounts so I am assuming it is a permissions issue. I have gone into the lookup table and definition and both are shared globally and have the user listed with read access. I've also confirmed the field referenced in the join is in both the lookup table and definition.

Any idea why it is not allowing this user to run the search?

0 Karma
1 Solution

mdsnmss
SplunkTrust
SplunkTrust

Kept troubleshooting and it was a permissions issue. The account needed access to the index, the lookup table, and the app the lookup table was in. We had the first two and with the lookup table shared globally and permissions granted to the user for read access to it thought it should work outside of the app context. Adding read access to the app it was contained in allowed the search to run.

View solution in original post

mdsnmss
SplunkTrust
SplunkTrust

Kept troubleshooting and it was a permissions issue. The account needed access to the index, the lookup table, and the app the lookup table was in. We had the first two and with the lookup table shared globally and permissions granted to the user for read access to it thought it should work outside of the app context. Adding read access to the app it was contained in allowed the search to run.

sbbadri
Motivator

try below

| JOIN [|inputlookup .csv]

i think your are missing pipe in fornt of inputlookup

0 Karma

mdsnmss
SplunkTrust
SplunkTrust

It works with or without the pipe for my account.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...