Splunk Search

Unable to use lookup

thirumalreddyb
Communicator

I have a problem, I configured a lookup table, defined it and set automatic lookup. When i tried to run a simple command sourcetype=csv-20
The error shows "Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'csv-20' and lookup table 'sample_lookups'."
Please correct me if i'm missing something in the configurations.
Note:There are no hidden characters in the lookup file.

props.conf

[csv-20]
KV_MODE = none
REPORT-AutoHeader = AutoHeader-6
SHOULD_LINEMERGE = False
given_type = csv
pulldown_type = true
CHECK_FOR_HEADER = False
LOOKUP-sample_lookups = sample_lookups productId OUTPUTNEW price, description

transforms.conf

[sample_lookups]
filename = sample_lookups.csv

Input file

A1,3
A2,2
A3,7
A4,8
A5,9

Lookup table

productId,price,description
A1,10.0,Bathing_Bar
A2,12.25,Tooth_brush
A3,6.5,Tooth_paste
A4,7.96,deo
A5,12.5,Mars_choco

Tags (1)
0 Karma
1 Solution

linu1988
Champion

I guess you have mentioned the column name "productId" in your input file. Rest of the things are correctly done.

"|inputcsv input.csv|lookup sample_lookups productId" is giving you the desired result

View solution in original post

linu1988
Champion

I guess you have mentioned the column name "productId" in your input file. Rest of the things are correctly done.

"|inputcsv input.csv|lookup sample_lookups productId" is giving you the desired result

linu1988
Champion

could you write me the query where you are using sourcetype? i may be able to help!

0 Karma

thirumalreddyb
Communicator

" |inputlookup sample_lookups" command retrieves me with the lookup table with three columns.

But when i run "sourcetype=csv-20" command; the error still shows up.
"Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'csv-20' and lookup table 'sample_lookups'."

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...

Network to App: Observability Unlocked [May & June Series]

In today’s digital landscape, your environment is no longer confined to the data center. It spans complex ...