Splunk Search

Why am I getting error "The lookup table 'mylookuptable' does not exist. It is referenced by configuration 'my_lookuptype'"?

New Member

I have this data below and I want a flow chart of start time and end time on the x-axis and cmd1, cmd2......on the y-axis.

03-25-2015 03:04:31.189, cmd1 = Start_time_of_if 
03-25-2015 03:09:31.189, cmd1 = end_time_of_if  
03-25-2015 03:12:31.189, cmd2 = Start_time_of_if 
03-25-2015 03:17:31.189, cmd2 = end_time_of_if 
03-25-2015 03:20:31.189, cmd3 = Start_time_of_grep 
03-25-2015 03:24:31.189, cmd3 = end_time_of_grep 
03-25-2015 03:27:31.189, cmd4 = Start_time_of_if 
03-25-2015 03:32:31.189, cmd4 = end_time_of_if 
03-25-2015 03:38:31.189, cmd5 = Start_time_of_sed_command 
03-25-2015 03:42:31.189, cmd5 = end_time_of_sed_command 
03-25-2015 03:49:31.189, cmd6 = Start_time_of_if 
03-25-2015 03:55:31.189, cmd6 = End_time_of_if 

Can you please help me solve this question?

I used this search:

|rex field=_raw "^(?P[^ ]+)\s+,\s+(?P\w+)\s+=\s+(?P\w+\s+\w+) of (?P.+)"|eval start_time=if(status="Start time",Time,"")|eval end_time=if(status="end time" OR status="End time",Time,"")|table cmd_name,command,start_time,end_time|stats max(start_time) as start_time,max(end_time) as end_time by cmd_name,command 

but I'm getting an error:

The lookup table 'mylookuptable' does not exist. It is referenced by configuration 'my_lookuptype'. 

and I've done some configurations for this. Can u please give guidance on how to solve this question?Thank UUUUUUUUUUUUUUUUUUUUU

Tags (2)
0 Karma


In case you haven't got the answer for it: I faced the similar issue yesterday when I try to configure props.conf in the local directory. I copied everything from props.conf.example ( http://docs.splunk.com/Documentation/Splunk/7.1.1/Admin/Propsconf ) and there we have :

# The following example shows how to configure lookup tables
LOOKUP-foo = mylookuptable userid AS myuserid OUTPUT username AS myusername

which was the root cause of this issue. I disabled it (put # in front of these lines) and restarted Splunk. Everything is working fine now. I am writing here to help someone who might face the same issue with Splunk 7x.

0 Karma

New Member

ya permissions have for that @stephane_cyrille

0 Karma

Path Finder

i can't help you if i don't have your files. can you send it me?
this my address tiwa.romuald@yahoo.fr

0 Karma


check the lookup table permissions.

0 Karma
Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...