lookup not found errors

[robgreen]

i have yet to get lookups to work correctly in an app.

The file is in the right place

/opt/splunk/etc/apps/myapp/lookups

[root@splunkui111 lookups]# ls -ltr
-rw-r--r-- 1 root root 22220462 Dec 13 18:13 nanpa-sorta-nothousands.csv

i have it in my props.conf

[hosted_file]
LOOKUP-npanxx = npanxx NPA NXX OUTPUTS City, State, LATA, CLLI, Company, OCN, SwitchType, SwitchName, PrefixType, Ratecenter

and in my transforms.conf

[npanxx]
filename=nanpa-sorta-nothousands.csv

If i look at /opt/splunk/var/run/searchpeers/splunkui111-1324253269
i can see the file is there

[root@splunk111 lookups]# ls -ltr
total 21700
-rw-r--r-- 1 root root 22220462 Dec 19 00:07 nanpa-sorta-nothousands.csv
[root@splunk111 lookups]# pwd
/opt/splunk/var/run/searchpeers/splunkui111-1324253269/apps/myapp/lookups

I have separate servers from the indexer and the search heads so i am assuming i am suppose to put on the SH but i have also tried each indexer.

Am i missing a file permission issue/owner/group issue here? i get errors in the message area at the top for all searches and manually trying to do the lookup also fails.

rob

[dwaddle · Accepted solution]

Are you doing your searches that use the lookup from within the app that the lookup is defined in? Or, are you doing them from the search app? You might need to export the lookup to all apps.

[Paolo_Prigione]

Aside of this, in case you will have lookups updated by scheduled searches with the outputlookup command, keep the filename and transforms stanza name consistent (i.e. the same, except for the .csv extensions). I experienced some misbehaviour when the names were not identical

[robgreen]

that was it.. that explains why it worked when i put in the /etc/system/local folder.

thanks