Splunk Search

Lookup table is invalid: Extra Commas?

aapittts
Path Finder

I have a lookup table that I am getting an invalid error on. I believe its because there are extra commas in the data. The lookup table is two fields: codes and descriptions. The descriptions naturally have some commas in them. Is it possible that this is causing the invalid table error? If so, can I create custom regex for this issue?

Tags (1)
0 Karma
1 Solution

cramasta
Builder

I tried throwing extra commas in one of my lookups but it did not throw a error, it just messed up the data that the lookup provided.

Try putting text qualifiers "" around your fields like this

"item1", "some text with a , in it"
"item2", "another text with 2 ,, "

This will allow it to ignore commas that are part of the description

View solution in original post

0 Karma

barakreeves
Splunk Employee
Splunk Employee

I have run into the same issue before on a "simple" lookup table having only 2 fields and also had trouble finding the issue. This is what I did:

1- search for line break at the end of the line
2- search for lines not matching pattern "your data", "your data" such as a line with only 1 value or no value; sometimes Excel torques an innocent csv file and therefore, I try to do a quick eyeball check in my favorite text editor
3- check the limits.conf under the stanza "lookup" to see if it is a size violation

Wish you success!

0 Karma

cramasta
Builder

I tried throwing extra commas in one of my lookups but it did not throw a error, it just messed up the data that the lookup provided.

Try putting text qualifiers "" around your fields like this

"item1", "some text with a , in it"
"item2", "another text with 2 ,, "

This will allow it to ignore commas that are part of the description

0 Karma

fu8R5juiNP64AKI
Explorer

@aapitts What was your issue then? I am running into the same problem.

0 Karma

aapittts
Path Finder

My issue wasn't commas but this is good to know.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Laser Bananas and Edge Hubs: Exploring Operational Technology (OT) Data Through a ...

  OT is a different environment to traditional IT and can have interesting challenges when interfacing the ...

Event Series: Mastering AI Tokenomics and Splunk Agent Observability

Beyond the Black Box: Correlating AI Performance and Tokenomics with Splunk Agent Observability   As ...

span_metrics: The OpenTelemetry-Idiomatic Way to See Inside Your Services

You open a trace in Splunk Observability Cloud and everything looks fine. One root span, order-pipeline, with ...