Splunk Search

Splunk says lookup table doesn't exist, but it does

jambajuice
Communicator

Here is my transforms.conf for the lookup table in question:

[ossim_plugins] filename = ossim_plugins.csv max_matches = 1

Here is an example of one of the searches that references the lookup table:

search = sourcetype=ossim "Event received" NOT ((plugin_id>=1001 AND plugin_id<=1131) OR plugin_id=1597) | lookup ossim_plugins plugin_id OUTPUT plugin_name | timechart count by plugin_name

But Splunk is occasionally throwing the following error:

The lookup table 'ossim_plugins' does not exist. It is referenced by configuration 'ossim_plugins'.

The lookup table ossim_plugins.csv is located in the lookups directory of the app that the searches and dashboards are defined in.

Any ideas?

Thx.

Tags (1)

jambajuice
Communicator

Never mind... Somehow an entry was made in props.conf with the title [ossim_plugins] and the content of the stanza was garbled.

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...