Splunk Search

Why Error: [subsearch]: The lookup table 'dns_serves.csv' requires a .csv or KV store lookup definition?

siemengr
Engager

I'm trying to exclude specific src_ip addresses from the results of a firewall query (example below). The query completes, however the src_ip addresses are not excluded and the following error is returned: [subsearch]: The lookup table 'dns_serves.csv' requires a .csv or KV store lookup definition. 

Example:

index=firewall
| search NOT [|inputlookup dns_serves.csv | fields src_ip]
| table src_ip dest_ip signature

When running |inputlookup dns_servers.csv by itself the contents of the lookup are returned so I know the lookup is good. I've checked the lookup permissions, CSV encoding, and searches forum threads for a solution. 

 

Labels (1)
Tags (2)
0 Karma

jwhughes58
Contributor

I had the same error this morning.  I didn't have either the Lookup Table file or the Lookup definitions as global.  Once I changed them both to global, the error went away.

0 Karma

siemengr
Engager

Excluding the src_ip addresses is working now. I had a typo in my lookup name. The error is still present.

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Are you saying it is working or there is an error? I'm assuming the typo was serves.csv vs servers.csv, but if there is still an error, can you say what the current problem?

 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...