Splunk Search

Lookup does not return data

Contributor

I am doing a small proof of concept on lookup command.
I have a look up csv file with the table:

env    status    date
prod     up    7/21/2016
int      up    7/20/2016
sit     down   7/19/2016
qa      down   7/21/2016
test    down   7/20/2016
stage   down   7/18/2016

Now I have setup the lookup definition ( lookup_try ) with global permission.

Then I try to run this command:

index=* |head 1|eval env="Prod"|lookup lookup_try env OUTPUT status date 

It does not print the values of status and date. Where am I going wrong?

0 Karma
1 Solution

Motivator

You can make lookup search case insensitive by adding casesensitivematch =false in your lookup stanza.

View solution in original post

0 Karma

Motivator

You can make lookup search case insensitive by adding casesensitivematch =false in your lookup stanza.

View solution in original post

0 Karma

Esteemed Legend

Lookups are CASE-SENSITIVE by default (but there is a setting to make them case-insensitive). Try this (cut and paste exactly as is):

| noop | stats count AS env |eval env="prod" | lookup lookup_try env

Legend

are you sure of the name of the lookup? its name is lookuptry or lookuptry.csv?
You can try it with | inputlookup command
| inputlookup lookup_try.csv
Bye.
Giuseppe

0 Karma

Path Finder

Hi!

I suppose you've tested this search before and you can see your CSV list:
| inputlookup lookup_try.csv

If ok, try this:
index=* |head 1|eval env="prod"|lookup lookup_try env OUTPUT status date

Regards.

0 Karma