Solved: An update was made to the identities.csv and now I... - Splunk Community

Getting Data In

If I run:

| inputlookup identities.csv

xxxx results

That shows a different count in the results than

| datamodel("Identity_Management", "All_Identities")

yyyy results

What is going on? I thought I built my indentities.csv correctly.

1 Solution

Solution

Take a look at the python_modular_input.log file. This will give you clues as to what is happening. In this case, a field called _time was created and that is not allowed. I saw this error message:

ERROR pid=7888 tid=identity file=lookup_modinput.py:streaming_merge_task:283 | status="Exception when reading input files" exc=Field names cannot start with an underscore: '_time'

Once the field was corrected to not start with an underscore, things worked fine.

View solution in original post

Solution

Take a look at the python_modular_input.log file. This will give you clues as to what is happening. In this case, a field called _time was created and that is not allowed. I saw this error message:

ERROR pid=7888 tid=identity file=lookup_modinput.py:streaming_merge_task:283 | status="Exception when reading input files" exc=Field names cannot start with an underscore: '_time'

Once the field was corrected to not start with an underscore, things worked fine.

Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf25, and our Community

Thank you to everyone in the Splunk Community who joined us for .conf25, which kicked off with our iconic ...

Data Persistence in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. What happens if the OpenTelemetry collector ...

Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever

Now On Demand Whether you're managing complex deployments or looking to future-proof your data ...