Splunk Search

lookups>lookup definition> price_lookup popup in tutorial does not match and can't find lookup file prices.csv

MikeSilady
Explorer

I'm following the tutorial at your page 46. The popup menu that I see has a "Destination app" field with search above the Type: file-based field. You reference it in step 2. Must be an old screen shot of the popup menu.

My problem is in the Lookup file field. I get a list of csv files. I have loaded Windows App. The list does not include prices.csv.

When I check the lookup>lookup table files>search app I have this file listed: /opt/splunk/etc/apps/search/lookups/prices.csv

Can you direct me forward?
Thanks
Mike

0 Karma
1 Solution

MikeSilady
Explorer

I made a mistake when adding the Windows App.
I needed to follow instructions > install the Splunk Add-on for Windows in addition to the Windows App.

I disabled the Window App
I can continue with the tutorial

Mike

View solution in original post

0 Karma

MikeSilady
Explorer

I made a mistake when adding the Windows App.
I needed to follow instructions > install the Splunk Add-on for Windows in addition to the Windows App.

I disabled the Window App
I can continue with the tutorial

Mike

0 Karma

lukejadamec
Super Champion

When you create the Lookup Table File you need to select the correct app at the top of the screen. I'm guessing you selected Windows, or arrived at the screen from the Windows app and did not change the Destination App to search.

Either way, it's OK. You can change the permission for the lookup to apply to all apps, or you can create a new Lookup Table File and select the correct App from the Destination App dropdown.
With permissions, you can configure lookup files to be available only to one app, or available to all apps.

MikeSilady
Explorer

No go.

I've deleted the prices.csv table and Re-added it.

When adding a lookup table under the Search App, I still only get Window's App csv lookups in the pull down window. Is there a way to attach a screen shot?

Furthermore, I've moved it to another app and back into the Search App. I still get the same window's app lookup options.

I will research how to delete the windows app and try again. It's not a viable solution for a tool where I want many apps need to co-existing. One app should not corrupt another.

I need to finish this tutorial.

Mike

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...