Error in 'lookup' command: Cannot find the source field

[ktell]

I have a csv lookup table of IP addresses that I want to execute searches on server logs with, but I'm stopped by an error code (title). It tells me the source field (IP) isn't found in the lookup table (IP_lookup), but my lookup definition lists IP as a supported field. I've also tried adding the lookup field through the data model builder (no luck). 

Search query is

index="ef" | lookup IP_lookup IP as clientip OUTPUT IP2 as IP Address

For context, my lookup table has two duplicate columns of addresses. Any help would be appreciated.

[venkatasri]

@ktell 

That's strange! can you execute | inputlookup IP_lookup and share the 'field names/columns' exactly as they return they are case sensitive?

You query requires a quotes around something like this -  Share the exact error that you are getting.

index="ef" | lookup IP_lookup IP as clientip OUTPUT IP2 as "IP Address"

[ktell]

@venkatasri 

inputlookup returns IP and IP2 along with all the addresses in 2 columns

Full error message reads;

Error in 'lookup' command: Cannot find the source field 'IP' in the lookup table 'IP_lookup'.

[venkatasri · Accepted solution]

@ktell can you follow this link and find if csv having any special chars inside - Re: Error in 'lookup' command: Could not find all ... - Splunk Community

Is there lookup definitions already configured in backend props.conf related to same IP_lookup ?

[ktell]

Thanks for the suggestion, I'm not familiar with vi but I was able to get a clean csv file by avoiding notepad 

[ktell]

@venkatasri I'm not at my workstation anymore, I'll give your suggestions a try tomorrow or setup one later