Splunk Search
Highlighted

[hdfsprovider] Error in 'lookup' command: Could not find all of the specified lookup fields in the lookup table

Communicator

Hi all, I have a CSV lookup file to map with one field in my indexed data. The search was working perfectly before, but today, my search returned 0 results with this alert:

[hdfsprovider] Error in 'lookup' command: Could not find all of the specified lookup fields in the lookup table.

This is my search:

 index=skype_session  | rex "FromIPAddr\"\"\:\"\"(?<FromIPAddr>[^\"]+)\"\"\,\"\"ToIPAddr\"\"" |  rex "ToIPAddr\"\"\:\"\"(?<ToIPAddr>[^\"]+)\"\"\,\"\"FromBssid\"\""    | rex "MediaStartTime\"\"\:\"\"(?<MediaStartTime>[^\"]+)\." | rex "MediaEndTime\"\"\:\"\"(?<MediaEndTime>[^\"]+)\." |  rex "(?<FromUri>[a-zA-Z0-9_\-\.]+@[a-zA-Z0-9_\-\.]+\.[a-zA-Z]{2,5})\",\"(?<ToUri>[a-zA-Z0-9_\-\.]+@[a-zA-Z0-9_\-\.]+\.[a-zA-Z]{2,5})" | 
    lookup staff.csv email AS FromUri  | dedup FromUri |  where FromIPAddr!="" | stats count by department | sort - count

staff.csv looks like this (denoted with comma UTF-8): I wanted to check if indexed field FromUri exists in an email field in the lookup, and if yes, output the department field in the lookup.

|email|department|
|--------|-----------------|
|--------|-----------------|
I checked other questions and there are some stating maybe the Splunk version and .conf issues. But I didn't change .conf and my Splunk version is 6.5.2.

Does anyone know how to solve this? Thanks!

0 Karma
Highlighted

Re: [hdfsprovider] Error in 'lookup' command: Could not find all of the specified lookup fields in the lookup table

Champion
0 Karma
Highlighted

Re: [hdfsprovider] Error in 'lookup' command: Could not find all of the specified lookup fields in the lookup table

Communicator

Thanks for your comment but the problem remains. I have checked the file and there are no hidden chars. Any other suggestions?

0 Karma
Highlighted

Re: [hdfsprovider] Error in 'lookup' command: Could not find all of the specified lookup fields in the lookup table

Path Finder

Hi Dannili,

Check this thing with the use of KV store lookup, you might get your answer.

Thanks,
Bhavik

0 Karma