Splunk Search

Why is lookup command not working in Splunk REST API?

georgear7
Communicator

I'm consuming data from Splunk REST API endpoints for other purposes. However, it is throwing this error because I used the "lookup" command in the query. Could anyone assist me in resolving this issue?

If the "lookup" command is not used, the query works properly.


Error:
<?xml version="1.0" encoding="UTF-8"?>
<response>
<messages>
<msg type="FATAL">Error in 'lookup' command: Could not construct lookup 'master_sheet.csv, host, as, host, OUTPUT, LOB, Region, Application, Environment'. See search.log for more details.</msg>
</messages>
</response>

 

Query:
curl -k -u user:pass https://localhost:8089/services/search/jobs --data-urlencode search='search index=foo sourcetype=abc source=*fs.log | rex "(?<Date>.*)\|(?<Mounted>.*)\|(?<Size>.*)\|(?<Used>.*)\|(?<Avail>.*)\|(?<Used_PCT>.*)\|(?<Filesystem>.*)" | eval Used_PCT=replace(Used_PCT,"%","") | search Filesystem IN (/apps, /logs) | stats latest(*) as * by host,Filesystem | where Used_PCT>=80 | sort -Used_PCT | rename Used_PCT as "Use%" | table host,Filesystem,Size,Used,Avail,Use% | lookup master_sheet.csv host as host OUTPUT LOB,Region,Application,Environment | table host,LOB,Region,Application,Environment,Filesystem,Size,Used,Avail,"Use%"' -d id=mysearch_1234567

curl -u user:pass -k https://localhost:8089/services/search/jobs/mysearch_1234567/results --get -d output_mode=csv

 

Labels (1)
Tags (3)
0 Karma

manjunathmeti
Champion

Hi @georgear7,

1. Check if you can run the query in the search app
2. Check the API user role permissions to master_sheet.csv in Splunk

0 Karma

georgear7
Communicator

Hi @manjunathmeti ,

1. Check if you can run the query in the search app - Yes, it's runing fine & producing results
2. Check the API user role permissions to master_sheet.csv in Splunk - Lookup file is owned by my ID. So there should not be any permission issue.

0 Karma

Perichila
New Member

Hello @georgear7 ,

I have the same problem, i am unable to run queries with lookups in Splunk with python.

Have you fix that problem?

Thanks 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

have you try /servicesNS/ instead of /services/ ? Like this

curl -ku $PASS https://localhost:8089/servicesNS/nobody/search/search/jobs --data-urlencode ....

r. Ismo

0 Karma

manjunathmeti
Champion
Check search.log in Search job inspector for search SID.

Activity >> Jobs
0 Karma
Get Updates on the Splunk Community!

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...

From Alert to Resolution: How Splunk Observability Helps SREs Navigate Critical ...

It's 3:17 AM, and your phone buzzes with an urgent alert. Wire transfer processing times have spiked, and ...