Splunk Search

lookup table problem

my_splunk
Path Finder

I have already used lookup table with splunk 4.3 and i have never had problems.
With 5.0.1 i have a strange problem.
I have this in my ../etc/apps/search/local/props.conf file

[mycsv]
LOOKUP-calendar = calendar month OUTPUTNEW my_month

and in ../etc/apps/search/local/transforms.conf file

[calendar]
filename = calendar.csv

where calendar is in ../etc/apps/search/local/lookups

In manager console i have put lookup definition and lookup file objects to global.
At search time i have this error:
The lookup table 'calendar' does not exist. It is referenced by configuration 'mycsv'.

Can you healp me?

Thanks

Tags (1)
0 Karma

Ayn
Legend

You've put the csv file in the wrong location. It shouldn't be in etc/apps/search/local/lookups, it should be in a lookups directory directly under the app root, i.e. etc/apps/search/lookups.

Ayn
Legend

Did you restart Splunk after editing the configuration files?

my_splunk
Path Finder

This is my updating. I have seen that there are many known issues abouk lookup with 5.0.1 version and i think i found another.
When i use directly conf file (props, transforms) splunk do not find lookup definition, in fact in manager console lookup definition is empty. If i use web interface for lookup creation (i mean manager->lookup and then in order lookup file, lookup defition and automatic lookup) there are no problem.
I tjink this is a bug, how can i report it?

0 Karma

my_splunk
Path Finder

as soon as possible i try this same configuration in 4.3 splunk....

0 Karma

Ayn
Legend

I don't know, sorry - your conf looks OK to me.

0 Karma

my_splunk
Path Finder

Sorry, i have wrote a wrong thing in my post.
I have correctly put csv file in etc/apps/search/lookups
So why this error at search time?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...