Why is my lookup search returning error "All of the fields in the lookup table are specified as lookups, leaving no destination fields"?

[shanesmith30286]

Hello All,

I am a Splunk noob, and I am trying to make a lookup work. Specifically, I am creating a lookup table of IP addresses, which I then want to compare to my outbound firewall connections which target the IPs in the lookup.

Sample from the lookup CSV (file named bad_guys.csv):

Mal_IPs,
12.34.56.78,
22.33.44.55,

Sample Search:

sourcetype="cisco:asa" [lookup bad_guys.csv Mal_IPs as dest_ip]

When I run this search, I get the following error:

Error in 'lookup' command: All of the fields in the lookup table are specified as lookups, leaving no destination fields.

Pretty sure I am doing something bone-headed, but can't seem to figure out what it is. Any ideas? Thanks in advance!

[jstoner_splunk]

Not a bone-headed question, there is a fix and what you did was what I started off doing as well.

The challenge is that when using the lookup command with a lookup that has a single value in it, you need to have an OUTPUT defined otherwise, it does not have anything to show for the lookup that it performed.

In your case, | lookup bad_guys.csv Mal_IPs as dest_ip OUTPUT Mal_IPs is what I would probably do.

Keep in mind, that will return all relevant rows in the search whether or not a match occurs. The next line under my lookup would likely be | search Mal_IPs=* which will just return values that have a Mal_IPs in it, those will be the matches.

There are other ways of doing this as well but hopefully this gets you going in the right direction.

[MuhammadAbdelAa]

Thanks 🙂