splunk lookup not working!

[cassie90]

Hi, I just created a static CSV file for the splunk lookup. But when I upload it, it didn't appear in the pick field. I follow the exact same step in the tutorial but it just didn't work out.

My CSV file has:

DestinationIP,owner_id,owner

118.214.191.45,1,Noam Freedman

209.85.175.106,2,Google Inc.

66.220.149.32,3,Facebook Inc.

124.155.223.9,4,NOC SHI

I would like the splunk to display whenever they lookup the IP address they would know the name of the owner. The destination ip address is already in my log file.

[e82than]

your pipe as in the key next to the right closing square brackets which you have to use when you do a stats command or an eval command.

give us an example (paste the search command) of your search string and let us see if you're doing the right thing?

[cassie90]

[Website1.zip:./Website/Website]
LOOKUP-find_owner_name = find_owner_name DestinationIP AS DestinationIP OUTPUTNEW owner AS owner owner_id AS owner_id

the above one is under props.conf

[find_owner_name]
filename = find_owner_name.csv

and this one is under transforms.conf

[cassie90]

what do you mean by my pipe?

[rroberts]

What did you have in your pipe to lookup command for input and output?

[cassie90]

yeap is inside already. But it didn't work at all. I can't seems to find it in the pick field.

[JSapienza]

Did you verify the file exists in the users folder ? Example : /opt/splunk/etc/users/admin/search/lookups/