Splunk Search

Why am I getting error "The lookup table 'mylookuptable' does not exist. It is referenced by configuration 'my_lookuptype'"?

New Member

I have this data below and I want a flow chart of start time and end time on the x-axis and cmd1, cmd2......on the y-axis.

03-25-2015 03:04:31.189, cmd1 = Start_time_of_if 
03-25-2015 03:09:31.189, cmd1 = end_time_of_if  
03-25-2015 03:12:31.189, cmd2 = Start_time_of_if 
03-25-2015 03:17:31.189, cmd2 = end_time_of_if 
03-25-2015 03:20:31.189, cmd3 = Start_time_of_grep 
03-25-2015 03:24:31.189, cmd3 = end_time_of_grep 
03-25-2015 03:27:31.189, cmd4 = Start_time_of_if 
03-25-2015 03:32:31.189, cmd4 = end_time_of_if 
03-25-2015 03:38:31.189, cmd5 = Start_time_of_sed_command 
03-25-2015 03:42:31.189, cmd5 = end_time_of_sed_command 
03-25-2015 03:49:31.189, cmd6 = Start_time_of_if 
03-25-2015 03:55:31.189, cmd6 = End_time_of_if 

Can you please help me solve this question?

I used this search:

|rex field=_raw "^(?P[^ ]+)\s+,\s+(?P\w+)\s+=\s+(?P\w+\s+\w+) of (?P.+)"|eval start_time=if(status="Start time",Time,"")|eval end_time=if(status="end time" OR status="End time",Time,"")|table cmd_name,command,start_time,end_time|stats max(start_time) as start_time,max(end_time) as end_time by cmd_name,command 

but I'm getting an error:

The lookup table 'mylookuptable' does not exist. It is referenced by configuration 'my_lookuptype'. 

and I've done some configurations for this. Can u please give guidance on how to solve this question?Thank UUUUUUUUUUUUUUUUUUUUU

Tags (2)
0 Karma


In case you haven't got the answer for it: I faced the similar issue yesterday when I try to configure props.conf in the local directory. I copied everything from props.conf.example ( http://docs.splunk.com/Documentation/Splunk/7.1.1/Admin/Propsconf ) and there we have :

# The following example shows how to configure lookup tables
LOOKUP-foo = mylookuptable userid AS myuserid OUTPUT username AS myusername

which was the root cause of this issue. I disabled it (put # in front of these lines) and restarted Splunk. Everything is working fine now. I am writing here to help someone who might face the same issue with Splunk 7x.

0 Karma

New Member

ya permissions have for that @stephane_cyrille

0 Karma

Path Finder

i can't help you if i don't have your files. can you send it me?
this my address tiwa.romuald@yahoo.fr

0 Karma


check the lookup table permissions.

0 Karma
Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...