Splunk Search

Lookup fails unless using a table

klhogan
New Member

The query below produces the results expected, but if I remove the "table PSID" section (bolded) it fails, saying 22 errors were generated while executing. PSID is a parsed field, bolded in the event record shown.

"RA_GENERATED" | table PSID | lookup LocationLookup.csv PeopleSoftId AS PSID OUTPUT Brand

Event record:
1/16/20 11:23:09.989 AM strong text16 Jan 2020 11:23:09:989 | WARN | K320LE100005 | 1019178 | XXXR01 | MOSLoggingAspect | - RA_Generated 111 111 111| LangCode en| CountryCode USA

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

It sounds like the lookup file is not getting distributed to the indexers. One of the 22 error messages should confirm that.

The table command forces the query to be completed by the search head from that point and the SH is where the lookup file resides.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

It sounds like the lookup file is not getting distributed to the indexers. One of the 22 error messages should confirm that.

The table command forces the query to be completed by the search head from that point and the SH is where the lookup file resides.

---
If this reply helps you, Karma would be appreciated.

klhogan
New Member

I think you're right. Adding a local=true to the lookup seems to work. Thanks!

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...