Splunk Search

Why am I getting no results found when creating and searching my field lookups?

sushmitha_mj
Communicator

I used this document to create my lookup table and define fields
http://docs.splunk.com/Documentation/Splunk/6.4.3/SearchTutorial/Usefieldlookups

Then I saw how to search on the document below
http://docs.splunk.com/Documentation/Splunk/6.4.3/SearchTutorial/Searchwithfieldlookups

But I get no results found. I went through the steps several times. Why would it be ?

Tags (2)
0 Karma
1 Solution

sundareshr
Legend

Start with typing |inputlookup lookupfilename to see if you get any results. If you don't its probably a permissions issue. Check permissions for lookup table AND lookup definition (global vs app vs private).

If you do get results back, Verify values in the lookup file and values in index are identical (case, spelling etc)

View solution in original post

sundareshr
Legend

Start with typing |inputlookup lookupfilename to see if you get any results. If you don't its probably a permissions issue. Check permissions for lookup table AND lookup definition (global vs app vs private).

If you do get results back, Verify values in the lookup file and values in index are identical (case, spelling etc)

aaraneta_splunk
Splunk Employee
Splunk Employee

Hello @sushmitha_mj - Without knowing any more information about your current situation, it could have something to do with your lookup table file or your sharing permissions or even the search you’re trying to perform. It would be helpful to share more information in a comment below. The more information you provide to the Answers community, the greater chance that you’ll be able to get some help. Thank you 🙂

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...