Why the second csv cannot be read with inputlookup commond?

[xiyangyang]

I have 1.csv which can by read by splunk with
|inputlookup 1.csv
Now I uploaded 2.csv.
When I enter |inputlookup 2.csv, result of 1.csv is displayed in splunkweb.
By the way, if i upload the 2.csv in other splunk server, 2.csv can be read.
How can i fix this problem?

[xiyangyang]

We simply forgot to comment out "----".

Wrong transform.conf:

【zenkoku_lookup】
filename = zenkoku.csv

match_type = WILDCARD(city)

Correct transform.conf:

----------------------------

【zenkoku_lookup】
filename = zenkoku.csv
match_type = WILDCARD(city)

----------------------------

[woodcock]

You should click Accept on this answer to close the question.

[xiyangyang · Accepted solution]

This problem has been fixed. Something was wrong with the transform.conf.

[richgalloway]

Please explain what changes you made to transforms.conf so future readers may benefit.

[xiyangyang]

The request of
|inputlookup *

[xiyangyang]

The picture of file names of my all csv.file.

[pranav_agile]

what is the destination filename you have specified when you have uploaded each file?

[xiyangyang]

Both of 2 files are uploaded in D:\Splunk\etc\apps\search\lookups.
Other files were uploaded too, but none of them can be viewed by inputlookup comment. Please refer the picture.

[varad_joshi]

Pretty silly thing but tried clearing cache and cookies??

[xiyangyang]

Thank you for your advice. It didn't work.

[woodcock]

If this is true, it is a bug. However, I am exceedingly skeptical that it is true. Do the whole thing again with 3.csv and 4.csv. I am sure that you will spot your mistake. Be sure to name EVERYTHING differently.

[xiyangyang]

Actually the files name is zenkoku.csv and cate.csv. The contents are totally differnet.

[DalJeanis]

Gak. You actually named the files 1.csv and 2.csv? Try with myfile3.csv and see if you get the same issues.

There are separate sections of the interface, one for uploading lookup tables and one for uploading other csvs. which did you use? Did you use the lookup table interface to upload the table, and then to define the table?

[xiyangyang]

The files names are actually zenkoku.csv and cate.csv.
The contents are totally different.
I used "Lookup table files" in Settings menu.
I cannot recreate this in other splunk sever either.
I tried to delete cookie and history in browser, but nothing changed.

[niketn]

@xiyangyang which version of Splunk are you using? I was unable to recreate this. I am able to access both files through inputlookup in Splunk 6.5.2.

[xiyangyang]

My splunk version is 6.2.3.
I did this successful with 6.2.3 splunk server.

[xiyangyang]

Even i enter
|inputlookup *
The 1.csv is shown in splunk web.
Doesn't it strang?