Splunk Search

lookups>lookup definition> price_lookup popup in tutorial does not match and can't find lookup file prices.csv

MikeSilady
Explorer

I'm following the tutorial at your page 46. The popup menu that I see has a "Destination app" field with search above the Type: file-based field. You reference it in step 2. Must be an old screen shot of the popup menu.

My problem is in the Lookup file field. I get a list of csv files. I have loaded Windows App. The list does not include prices.csv.

When I check the lookup>lookup table files>search app I have this file listed: /opt/splunk/etc/apps/search/lookups/prices.csv

Can you direct me forward?
Thanks
Mike

0 Karma
1 Solution

MikeSilady
Explorer

I made a mistake when adding the Windows App.
I needed to follow instructions > install the Splunk Add-on for Windows in addition to the Windows App.

I disabled the Window App
I can continue with the tutorial

Mike

View solution in original post

0 Karma

MikeSilady
Explorer

I made a mistake when adding the Windows App.
I needed to follow instructions > install the Splunk Add-on for Windows in addition to the Windows App.

I disabled the Window App
I can continue with the tutorial

Mike

0 Karma

lukejadamec
Super Champion

When you create the Lookup Table File you need to select the correct app at the top of the screen. I'm guessing you selected Windows, or arrived at the screen from the Windows app and did not change the Destination App to search.

Either way, it's OK. You can change the permission for the lookup to apply to all apps, or you can create a new Lookup Table File and select the correct App from the Destination App dropdown.
With permissions, you can configure lookup files to be available only to one app, or available to all apps.

MikeSilady
Explorer

No go.

I've deleted the prices.csv table and Re-added it.

When adding a lookup table under the Search App, I still only get Window's App csv lookups in the pull down window. Is there a way to attach a screen shot?

Furthermore, I've moved it to another app and back into the Search App. I still get the same window's app lookup options.

I will research how to delete the windows app and try again. It's not a viable solution for a tool where I want many apps need to co-existing. One app should not corrupt another.

I need to finish this tutorial.

Mike

0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...