Splunk Search

Why am I getting error "The lookup table 'mylookuptable' does not exist. It is referenced by configuration 'my_lookuptype'"?

ravigampa
New Member

I have this data below and I want a flow chart of start time and end time on the x-axis and cmd1, cmd2......on the y-axis.

03-25-2015 03:04:31.189, cmd1 = Start_time_of_if 
03-25-2015 03:09:31.189, cmd1 = end_time_of_if  
03-25-2015 03:12:31.189, cmd2 = Start_time_of_if 
03-25-2015 03:17:31.189, cmd2 = end_time_of_if 
03-25-2015 03:20:31.189, cmd3 = Start_time_of_grep 
03-25-2015 03:24:31.189, cmd3 = end_time_of_grep 
03-25-2015 03:27:31.189, cmd4 = Start_time_of_if 
03-25-2015 03:32:31.189, cmd4 = end_time_of_if 
03-25-2015 03:38:31.189, cmd5 = Start_time_of_sed_command 
03-25-2015 03:42:31.189, cmd5 = end_time_of_sed_command 
03-25-2015 03:49:31.189, cmd6 = Start_time_of_if 
03-25-2015 03:55:31.189, cmd6 = End_time_of_if 

Can you please help me solve this question?

I used this search:

|rex field=_raw "^(?P[^ ]+)\s+,\s+(?P\w+)\s+=\s+(?P\w+\s+\w+) of (?P.+)"|eval start_time=if(status="Start time",Time,"")|eval end_time=if(status="end time" OR status="End time",Time,"")|table cmd_name,command,start_time,end_time|stats max(start_time) as start_time,max(end_time) as end_time by cmd_name,command 

but I'm getting an error:

The lookup table 'mylookuptable' does not exist. It is referenced by configuration 'my_lookuptype'. 

and I've done some configurations for this. Can u please give guidance on how to solve this question?Thank UUUUUUUUUUUUUUUUUUUUU

Tags (2)
0 Karma

Chandras11
Communicator

In case you haven't got the answer for it: I faced the similar issue yesterday when I try to configure props.conf in the local directory. I copied everything from props.conf.example ( http://docs.splunk.com/Documentation/Splunk/7.1.1/Admin/Propsconf ) and there we have :

# The following example shows how to configure lookup tables
[my_lookuptype]
LOOKUP-foo = mylookuptable userid AS myuserid OUTPUT username AS myusername

which was the root cause of this issue. I disabled it (put # in front of these lines) and restarted Splunk. Everything is working fine now. I am writing here to help someone who might face the same issue with Splunk 7x.

0 Karma

ravigampa
New Member

ya permissions have for that @stephane_cyrille

0 Karma

Tanefo
Path Finder

i can't help you if i don't have your files. can you send it me?
this my address tiwa.romuald@yahoo.fr

0 Karma

stephane_cyrill
Builder

Hi,
check the lookup table permissions.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...