Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Lookup table is invalid: Extra Commas?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a lookup table that I am getting an invalid error on. I believe its because there are extra commas in the data. The lookup table is two fields: codes and descriptions. The descriptions naturally have some commas in them. Is it possible that this is causing the invalid table error? If so, can I create custom regex for this issue?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I tried throwing extra commas in one of my lookups but it did not throw a error, it just messed up the data that the lookup provided.
Try putting text qualifiers "" around your fields like this
"item1", "some text with a , in it"
"item2", "another text with 2 ,, "
This will allow it to ignore commas that are part of the description
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have run into the same issue before on a "simple" lookup table having only 2 fields and also had trouble finding the issue. This is what I did:
1- search for line break at the end of the line
2- search for lines not matching pattern "your data", "your data" such as a line with only 1 value or no value; sometimes Excel torques an innocent csv file and therefore, I try to do a quick eyeball check in my favorite text editor
3- check the limits.conf under the stanza "lookup" to see if it is a size violation
Wish you success!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I tried throwing extra commas in one of my lookups but it did not throw a error, it just messed up the data that the lookup provided.
Try putting text qualifiers "" around your fields like this
"item1", "some text with a , in it"
"item2", "another text with 2 ,, "
This will allow it to ignore commas that are part of the description
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@aapitts What was your issue then? I am running into the same problem.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
My issue wasn't commas but this is good to know.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
