Lookup missing definition

[victornajduch]

Good afternoon, 

I can't make sense of why I can't extract a definition from a particular csv. 
I doublechecked permissions and verified that all of my columns are appearing via | inputlookup file.csv | table loopback, device

the output recognizes both the custom device data as well as loopback but if I attempt to table the info "device" is not recognized. 

index=index "syslog message"
| rex field=_raw "peer (?<neighbor>\d+.\d+.\d+.\d+.)" | dedup neighbor

| lookup xo-access-loopback loopback as neighbor output device | table device, neighbor

I get neighbor output but not device. 
csv looks like - 
Any ideas?

device	loopback
routername	x.x.x.x

[venkatasri]

Hi @victornajduch 

I am hoping 'neighbor' is correctly extracted. The lookup file could be sometimes having hidden chars not visible through normal text editors, you can try opening it using vi/vim/emacs editors to find and clear these chars.

---

An upvote would be appreciated and Accept  solution if this reply helps!

[venkatasri]

@victornajduch  Similar issue has been answered here - Solved: Error in 'lookup' command: Cannot find the source ... - Splunk Community

[victornajduch]

@venkatasri checked for special characters and added a 3 (superfluous) column. No change.