Splunk Search

Why doesn't the Automatic lookup work?

rajneeshc1981
Explorer

I have a new lookup setup I want to query against it .presently its not working may I know what I have to do in order to get it setup for auto lookup.

thanks

0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

1) Try manually checking the data

| inputlookup mylookup.csv

that should tell you if it's there.

2) Try manually testing a lookup. Assuming the name of the lookup field is foo, and one record in the lookup the field foo has a value of "bar", and there is another column named baz.

| makeresults 
| eval foo = "bar"
| lookup mylookup.csv foo OUTPUT baz 

If both of those work, then you have probably set up the lookup itself incorrectly. If one of them fails, then either the definition is wrong, the lookup name is wrong, or the data is wrong.

View solution in original post

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...