Splunk Search

Lookup missing definition

victornajduch
Loves-to-Learn Everything

Good afternoon, 

I can't make sense of why I can't extract a definition from a particular csv. 
I doublechecked permissions and verified that all of my columns are appearing via | inputlookup file.csv | table loopback, device

the output recognizes both the custom device data as well as loopback but if I attempt to table the info "device" is not recognized. 

index=index "syslog message"
| rex field=_raw "peer (?<neighbor>\d+.\d+.\d+.\d+.)" | dedup neighbor

| lookup xo-access-loopback loopback as neighbor output device | table device, neighbor

I get neighbor output but not device. 
csv looks like - 
Any ideas?

deviceloopback
routernamex.x.x.x
Labels (1)
Tags (1)
0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @victornajduch 

I am hoping 'neighbor' is correctly extracted. The lookup file could be sometimes having hidden chars not visible through normal text editors, you can try opening it using vi/vim/emacs editors to find and clear these chars.

---

An upvote would be appreciated and Accept  solution if this reply helps!

0 Karma

venkatasri
SplunkTrust
SplunkTrust
0 Karma

victornajduch
Loves-to-Learn Everything

@venkatasri checked for special characters and added a 3 (superfluous) column. No change.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...