Splunk Search

Unable to use lookup

thirumalreddyb
Communicator

I have a problem, I configured a lookup table, defined it and set automatic lookup. When i tried to run a simple command sourcetype=csv-20
The error shows "Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'csv-20' and lookup table 'sample_lookups'."
Please correct me if i'm missing something in the configurations.
Note:There are no hidden characters in the lookup file.

props.conf

[csv-20]
KV_MODE = none
REPORT-AutoHeader = AutoHeader-6
SHOULD_LINEMERGE = False
given_type = csv
pulldown_type = true
CHECK_FOR_HEADER = False
LOOKUP-sample_lookups = sample_lookups productId OUTPUTNEW price, description

transforms.conf

[sample_lookups]
filename = sample_lookups.csv

Input file

A1,3
A2,2
A3,7
A4,8
A5,9

Lookup table

productId,price,description
A1,10.0,Bathing_Bar
A2,12.25,Tooth_brush
A3,6.5,Tooth_paste
A4,7.96,deo
A5,12.5,Mars_choco

Tags (1)
0 Karma
1 Solution

linu1988
Champion

I guess you have mentioned the column name "productId" in your input file. Rest of the things are correctly done.

"|inputcsv input.csv|lookup sample_lookups productId" is giving you the desired result

View solution in original post

linu1988
Champion

I guess you have mentioned the column name "productId" in your input file. Rest of the things are correctly done.

"|inputcsv input.csv|lookup sample_lookups productId" is giving you the desired result

linu1988
Champion

could you write me the query where you are using sourcetype? i may be able to help!

0 Karma

thirumalreddyb
Communicator

" |inputlookup sample_lookups" command retrieves me with the lookup table with three columns.

But when i run "sourcetype=csv-20" command; the error still shows up.
"Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'csv-20' and lookup table 'sample_lookups'."

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...