Splunk Search

lookups>lookup definition> price_lookup popup in tutorial does not match and can't find lookup file prices.csv

MikeSilady
Explorer

I'm following the tutorial at your page 46. The popup menu that I see has a "Destination app" field with search above the Type: file-based field. You reference it in step 2. Must be an old screen shot of the popup menu.

My problem is in the Lookup file field. I get a list of csv files. I have loaded Windows App. The list does not include prices.csv.

When I check the lookup>lookup table files>search app I have this file listed: /opt/splunk/etc/apps/search/lookups/prices.csv

Can you direct me forward?
Thanks
Mike

0 Karma
1 Solution

MikeSilady
Explorer

I made a mistake when adding the Windows App.
I needed to follow instructions > install the Splunk Add-on for Windows in addition to the Windows App.

I disabled the Window App
I can continue with the tutorial

Mike

View solution in original post

0 Karma

MikeSilady
Explorer

I made a mistake when adding the Windows App.
I needed to follow instructions > install the Splunk Add-on for Windows in addition to the Windows App.

I disabled the Window App
I can continue with the tutorial

Mike

0 Karma

lukejadamec
Super Champion

When you create the Lookup Table File you need to select the correct app at the top of the screen. I'm guessing you selected Windows, or arrived at the screen from the Windows app and did not change the Destination App to search.

Either way, it's OK. You can change the permission for the lookup to apply to all apps, or you can create a new Lookup Table File and select the correct App from the Destination App dropdown.
With permissions, you can configure lookup files to be available only to one app, or available to all apps.

MikeSilady
Explorer

No go.

I've deleted the prices.csv table and Re-added it.

When adding a lookup table under the Search App, I still only get Window's App csv lookups in the pull down window. Is there a way to attach a screen shot?

Furthermore, I've moved it to another app and back into the Search App. I still get the same window's app lookup options.

I will research how to delete the windows app and try again. It's not a viable solution for a tool where I want many apps need to co-existing. One app should not corrupt another.

I need to finish this tutorial.

Mike

0 Karma
Get Updates on the Splunk Community!

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...