Splunk Search
Highlighted

error: 'lookup-table-files': File is binary and not gzipped

Explorer

Hi,
I am trying to add a new lookup table using the GUI and get the above error.
I looked at the file with a hex editor and it looks like a plain ascii file.
Any ideas?
Thx
Yona

Tags (1)
Highlighted

Re: error: 'lookup-table-files': File is binary and not gzipped

Splunk Employee
Splunk Employee

Need more information. Perhaps you can let us know your configuration settings, OS, and what the contents of the lookup file are?

0 Karma
Highlighted

Re: error: 'lookup-table-files': File is binary and not gzipped

Contributor

Maybe there is a special character in the CSV file. If you are on a unix host, you could try the folowing:

strings orig.csv >new.csv
diff orig.csv new.csv

If the two files are the same, then they probably are plain text.

0 Karma
Highlighted

Re: error: 'lookup-table-files': File is binary and not gzipped

Explorer

I am using a windows 7 machine, the lookup file is the following:
Process,in
LtMSSp,1
Kerberos,1
I looked with a hex editor and could not see any charater except for CR and LF at the end of each line in addition to the text.

Highlighted

Re: error: 'lookup-table-files': File is binary and not gzipped

Contributor

Could there be a spurious NULL or ^Z at the end of the file? Did you try cutting and pasting the file into a new text file in Notepad and saving it from there?

0 Karma
Highlighted

Re: error: 'lookup-table-files': File is binary and not gzipped

Contributor

I had the same problems until I figured out that splunk fails on reading CSV files containing special characters like the German Umlaut chars like "ä", "ö", "ü" or "ß". I suppose the problem would be the same with other special characters in French ("á") and Spanish ("ñ").

0 Karma
Highlighted

Re: error: 'lookup-table-files': File is binary and not gzipped

Explorer

Thanks every one for the kind help. Just a quick update: I used the same file on another system and things worked just fine. I am still don't understand what is the reason for it not to work on my machine. I looked carefully with a hexeditor and could not find any special character... I will put more time to it next week and will try to update if I find anything interesting.

0 Karma
Highlighted

Re: error: 'lookup-table-files': File is binary and not gzipped

Contributor

I used Notepad++ to fix this problem.
Search for [^\x00-\x7F] in Regex Mode.

0 Karma
Highlighted

Re: error: 'lookup-table-files': File is binary and not gzipped

Contributor

I used Notepad++ to fix this problem.
Search for [^\x00-\x7F] in Regex Mode.

0 Karma
Highlighted

Re: error: 'lookup-table-files': File is binary and not gzipped

Communicator

I'm generating my .csv file using a python library for csv. I have tried changing my line endings from \r to \n to \r\n
I have also tried using unix2dos and dos2unix to change line endings. I don't see any special characters. I have tried the strings trick. It removed the ^m from the end of the line. That file would also not upload.

BTW I'm using OS X and am wondering if the Mac line endings might be causing the trouble.

0 Karma