Splunk Search

Lookup upload Error

aniketb
Path Finder

Hi,

I have an alert set up to compare hosts with my look-up table .csv file. It was working fine in Splunk 4.3.3 build 128297.
We recently did a failover to Splunk 4.2.1(98164) and I'm not able to recreate this.

This file just won't upload. It gives the following error:

Encountered the following error while trying to save: In handler 'lookup-table-files': Error performing action=create on object id=testfile.csv in config=lookups.

I am a privileged user. I did this without a problem earlier. I asked my admin to upload it, he received the same error. What could be the issue?

edit: Found a difference in where splunk saves the files. (Assume my username as aniketb)

Splunk 4.3.3 saved the lookup to: /opt/splunk/etc/apps/search/lookups/testfile.csv
Splunk 4.2.1 saved to: /opt/splunk/etc/users/aniketb/search/lookups/testfile.csv

Does this point to any error?

Tags (4)
0 Karma

aakwah
Builder

This issue happened with me when I've a column that has German letters ü,ß,ä ...
after I removed this column from csv file it uploaded successfully

0 Karma

aniketb
Path Finder

The scheduled search uses inputlookup.
I'm using this from security point to monitor access by trusted hosts. Since this is a learning phase, after the alerts are flagged, we review if we have to add the flagged ones to the trusted list.

Related to: http://splunk-base.splunk.com/answers/54370/updating-a-lookup-table-by-external-means

0 Karma

sideview
SplunkTrust
SplunkTrust

What is it that keeps updating the host list? For instance is it a scheduled search that uses the outputlookup command, or is it a script that just writes a new file to disk? I'm wondering if it's some difference around file permissions in lookup handling, between 4.3 and 4.2.X.

0 Karma

aniketb
Path Finder

Maybe yes but that would be a one time workaround. The host list keeps updating, you can't go to admin every time to upload the lookup. We tried with setting all permissions ON, still got the same error.
Any possible hints to configuration problems?

0 Karma

lguinn2
Legend

Can the admin copy the file into the appropriate lookups directory from the command line (Linux, Windows, whatever)?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...