Use search results to populate a lookup table

[bnorthway]

I am following the directions on http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/Addfieldsfromexternaldatasources#Use_sea...

I edited my savedsearches.conf as directed, but the CSV file is not being created. How can I troubleshoot this problem?

etc/apps/search/local/savedsearches.conf:

[Service Now assets]
action.email.reportServerEnabled = 0
action.email.useNSSubject = 1
action.populate_lookup = 1
action.populate_lookup.dest = etc/system/lookups/service_now_assets.csv
alert.digest_mode = True
alert.suppress = 0
alert.track = 0
auto_summarize.dispatch.earliest_time = -1d@h
counttype = number of events
cron_schedule = 0 18 * * *
description = ServiceNow assets
display.events.fields = ["sourcetype","Message_Name","source","Message_Info","Message_Title","Server","msg","Server"]
display.events.type = table
display.visualizations.charting.chart = area
display.visualizations.show = 0
enableSched = 1
quantity = 5000
relation = less than
request.ui_dispatch_app = search
request.ui_dispatch_view = search
run_on_startup = false
search = index=service_now source=service_now earliest=-1d

etc/system/local/transforms.conf:

[service_now_asset]
filename = etc/system/lookups/service_now_assets.csv
case_sensitive_match = false

etc/system/local/props.conf:

[asset_properties]
LOOKUP-servicenow = service_now_asset Server

[woodcock]

I know this seems silly but every time I use a construct referring to a file location that is relative to $SPLUNK_HOME, I have used /etc/... instead of etc/.... I know the documentation says the latter but I would add a slash to the beginning and see if it fixes it.

[bnorthway]

I removed the path entirely and Splunk was able to find the CSV correctly! Running the saved search does not update the CSV, but at least the lookup part is working...

[woodcock]

Keep playing with different variations on the path and I think you will get it.

[woodcock]

Paste your savedsearches.conf stanza; there is probably a typo.

[richgalloway]

Did you restart Splunk after editing savedsearches.conf? What were your edits?

[bnorthway]

yes I have restarted. I posted the relevant sections from my config files