Why is lookup command not working in Splunk REST API?

[georgear7]

I'm consuming data from Splunk REST API endpoints for other purposes. However, it is throwing this error because I used the "lookup" command in the query. Could anyone assist me in resolving this issue?

If the "lookup" command is not used, the query works properly.

Error:
<?xml version="1.0" encoding="UTF-8"?>
<response>
<messages>
<msg type="FATAL">Error in 'lookup' command: Could not construct lookup 'master_sheet.csv, host, as, host, OUTPUT, LOB, Region, Application, Environment'. See search.log for more details.</msg>
</messages>
</response>

Query:
curl -k -u user:pass https://localhost:8089/services/search/jobs --data-urlencode search='search index=foo sourcetype=abc source=*fs.log | rex "(?<Date>.*)\|(?<Mounted>.*)\|(?<Size>.*)\|(?<Used>.*)\|(?<Avail>.*)\|(?<Used_PCT>.*)\|(?<Filesystem>.*)" | eval Used_PCT=replace(Used_PCT,"%","") | search Filesystem IN (/apps, /logs) | stats latest(*) as * by host,Filesystem | where Used_PCT>=80 | sort -Used_PCT | rename Used_PCT as "Use%" | table host,Filesystem,Size,Used,Avail,Use% | lookup master_sheet.csv host as host OUTPUT LOB,Region,Application,Environment | table host,LOB,Region,Application,Environment,Filesystem,Size,Used,Avail,"Use%"' -d id=mysearch_1234567

curl -u user:pass -k https://localhost:8089/services/search/jobs/mysearch_1234567/results --get -d output_mode=csv

[manjunathmeti]

Hi @georgear7,

1. Check if you can run the query in the search app
2. Check the API user role permissions to master_sheet.csv in Splunk

[georgear7]

Hi @manjunathmeti ,

1. Check if you can run the query in the search app - Yes, it's runing fine & producing results
2. Check the API user role permissions to master_sheet.csv in Splunk - Lookup file is owned by my ID. So there should not be any permission issue.

[Perichila]

Hello @georgear7 ,

I have the same problem, i am unable to run queries with lookups in Splunk with python.

Have you fix that problem?

Thanks 

[isoutamo]

Hi

have you try /servicesNS/ instead of /services/ ? Like this

curl -ku $PASS https://localhost:8089/servicesNS/nobody/search/search/jobs --data-urlencode ....

r. Ismo

[manjunathmeti]

Check search.log in Search job inspector for search SID.

Activity >> Jobs