Splunk Search

Splunk says lookup table doesn't exist, but it does

jambajuice
Communicator

Here is my transforms.conf for the lookup table in question:

[ossim_plugins] filename = ossim_plugins.csv max_matches = 1

Here is an example of one of the searches that references the lookup table:

search = sourcetype=ossim "Event received" NOT ((plugin_id>=1001 AND plugin_id<=1131) OR plugin_id=1597) | lookup ossim_plugins plugin_id OUTPUT plugin_name | timechart count by plugin_name

But Splunk is occasionally throwing the following error:

The lookup table 'ossim_plugins' does not exist. It is referenced by configuration 'ossim_plugins'.

The lookup table ossim_plugins.csv is located in the lookups directory of the app that the searches and dashboards are defined in.

Any ideas?

Thx.

Tags (1)

jambajuice
Communicator

Never mind... Somehow an entry was made in props.conf with the title [ossim_plugins] and the content of the stanza was garbled.

Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...