Splunk Search

Why the second csv cannot be read with inputlookup commond?

xiyangyang
Path Finder

I have 1.csv which can by read by splunk with
|inputlookup 1.csv
Now I uploaded 2.csv.
When I enter |inputlookup 2.csv, result of 1.csv is displayed in splunkweb.
By the way, if i upload the 2.csv in other splunk server, 2.csv can be read.
How can i fix this problem?

0 Karma
1 Solution

xiyangyang
Path Finder

This problem has been fixed. Something was wrong with the transform.conf.

View solution in original post

0 Karma

xiyangyang
Path Finder

We simply forgot to comment out "----".

Wrong transform.conf:

【zenkoku_lookup】
filename = zenkoku.csv

match_type = WILDCARD(city)

Correct transform.conf:

----------------------------

【zenkoku_lookup】
filename = zenkoku.csv
match_type = WILDCARD(city)

----------------------------

0 Karma

woodcock
Esteemed Legend

You should click Accept on this answer to close the question.

0 Karma

xiyangyang
Path Finder

This problem has been fixed. Something was wrong with the transform.conf.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please explain what changes you made to transforms.conf so future readers may benefit.

---
If this reply helps you, Karma would be appreciated.

xiyangyang
Path Finder

The request of
|inputlookup *alt text

0 Karma

xiyangyang
Path Finder

The picture of file names of my all csv.file.
alt text

0 Karma

pranav_agile
Explorer

what is the destination filename you have specified when you have uploaded each file?

0 Karma

xiyangyang
Path Finder

Both of 2 files are uploaded in D:\Splunk\etc\apps\search\lookups.
Other files were uploaded too, but none of them can be viewed by inputlookup comment. Please refer the picture.

0 Karma

varad_joshi
Communicator

Pretty silly thing but tried clearing cache and cookies??

0 Karma

xiyangyang
Path Finder

Thank you for your advice. It didn't work.

0 Karma

woodcock
Esteemed Legend

If this is true, it is a bug. However, I am exceedingly skeptical that it is true. Do the whole thing again with 3.csv and 4.csv. I am sure that you will spot your mistake. Be sure to name EVERYTHING differently.

0 Karma

xiyangyang
Path Finder

Actually the files name is zenkoku.csv and cate.csv. The contents are totally differnet.

0 Karma

DalJeanis
Legend

Gak. You actually named the files 1.csv and 2.csv? Try with myfile3.csv and see if you get the same issues.

There are separate sections of the interface, one for uploading lookup tables and one for uploading other csvs. which did you use? Did you use the lookup table interface to upload the table, and then to define the table?

0 Karma

xiyangyang
Path Finder

The files names are actually zenkoku.csv and cate.csv.
The contents are totally different.
I used "Lookup table files" in Settings menu.
I cannot recreate this in other splunk sever either.
I tried to delete cookie and history in browser, but nothing changed.

0 Karma

niketn
Legend

@xiyangyang which version of Splunk are you using? I was unable to recreate this. I am able to access both files through inputlookup in Splunk 6.5.2.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

xiyangyang
Path Finder

My splunk version is 6.2.3.
I did this successful with 6.2.3 splunk server.

0 Karma

xiyangyang
Path Finder

Even i enter
|inputlookup *
The 1.csv is shown in splunk web.
Doesn't it strang?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...