Splunk Search

Lookup table is invalid: Extra Commas?

aapittts
Path Finder

I have a lookup table that I am getting an invalid error on. I believe its because there are extra commas in the data. The lookup table is two fields: codes and descriptions. The descriptions naturally have some commas in them. Is it possible that this is causing the invalid table error? If so, can I create custom regex for this issue?

Tags (1)
0 Karma
1 Solution

cramasta
Builder

I tried throwing extra commas in one of my lookups but it did not throw a error, it just messed up the data that the lookup provided.

Try putting text qualifiers "" around your fields like this

"item1", "some text with a , in it"
"item2", "another text with 2 ,, "

This will allow it to ignore commas that are part of the description

View solution in original post

0 Karma

barakreeves
Splunk Employee
Splunk Employee

I have run into the same issue before on a "simple" lookup table having only 2 fields and also had trouble finding the issue. This is what I did:

1- search for line break at the end of the line
2- search for lines not matching pattern "your data", "your data" such as a line with only 1 value or no value; sometimes Excel torques an innocent csv file and therefore, I try to do a quick eyeball check in my favorite text editor
3- check the limits.conf under the stanza "lookup" to see if it is a size violation

Wish you success!

0 Karma

cramasta
Builder

I tried throwing extra commas in one of my lookups but it did not throw a error, it just messed up the data that the lookup provided.

Try putting text qualifiers "" around your fields like this

"item1", "some text with a , in it"
"item2", "another text with 2 ,, "

This will allow it to ignore commas that are part of the description

0 Karma

fu8R5juiNP64AKI
Explorer

@aapitts What was your issue then? I am running into the same problem.

0 Karma

aapittts
Path Finder

My issue wasn't commas but this is good to know.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Picture this. You arrive at .conf26 already having your socializing and networking plans mapped out. No ...

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

Implementing Zero Trust (ZT) across complex environments often falters at the very beginning due to a ...