Splunk Search

Lookup table is invalid: Extra Commas?

aapittts
Path Finder

I have a lookup table that I am getting an invalid error on. I believe its because there are extra commas in the data. The lookup table is two fields: codes and descriptions. The descriptions naturally have some commas in them. Is it possible that this is causing the invalid table error? If so, can I create custom regex for this issue?

Tags (1)
0 Karma
1 Solution

cramasta
Builder

I tried throwing extra commas in one of my lookups but it did not throw a error, it just messed up the data that the lookup provided.

Try putting text qualifiers "" around your fields like this

"item1", "some text with a , in it"
"item2", "another text with 2 ,, "

This will allow it to ignore commas that are part of the description

View solution in original post

0 Karma

barakreeves
Splunk Employee
Splunk Employee

I have run into the same issue before on a "simple" lookup table having only 2 fields and also had trouble finding the issue. This is what I did:

1- search for line break at the end of the line
2- search for lines not matching pattern "your data", "your data" such as a line with only 1 value or no value; sometimes Excel torques an innocent csv file and therefore, I try to do a quick eyeball check in my favorite text editor
3- check the limits.conf under the stanza "lookup" to see if it is a size violation

Wish you success!

0 Karma

cramasta
Builder

I tried throwing extra commas in one of my lookups but it did not throw a error, it just messed up the data that the lookup provided.

Try putting text qualifiers "" around your fields like this

"item1", "some text with a , in it"
"item2", "another text with 2 ,, "

This will allow it to ignore commas that are part of the description

0 Karma

fu8R5juiNP64AKI
Explorer

@aapitts What was your issue then? I am running into the same problem.

0 Karma

aapittts
Path Finder

My issue wasn't commas but this is good to know.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Between hands-on technical sessions, keynote reveals, and diving into live architectures, .conf26 is packed ...

Join the Hackathon at .conf26 and build a No-Code AI agent

Join us for the AI Agent Buildathon, an in-person, three-hour hands-on Hackathon where you’ll use Splunk Agent ...

Level Up Your Workflow: Mastering Splunk Cloud Management via Terraform

Tech Talk Recap   From Chaos to Control: Scaling Splunk Cloud with Infrastructure as Code Managing apps in ...