No sure if you've resolved this issue yet, but you can try to make sure your csv file is in this format? The format you have is a coma-delimited, but Splunk lookup table may not like that particular format. So you may want to try to fix the lookup table to make it look like this? Just sharing my suggestion. I encountered something that looks similar to this issue. Hope this helps. 🙂
Is anybody can help please?
is anybody can explain me what is wrong in my csv please?
Have you tried using "AS" instead of "as" in your lookup command?
it changes nothing, same message and same result
If you look at the error message, i think the csv is not interpreted correctly because you can see the fields are not separated correctly
Could not construct lookup 'debit.csv, entite, AS, site, output, sam, espace
But I dont understand what is wrong because when I am doing | inputlookup debit.csv, the data are correctly displayed
What do you get when you do this:
| inputlookup deb.csv
At the beginning it was working but when I executed the search, I did have the message below
Error in 'lookup' command: Could not construct lookup
But now when I try to upload the file, Splunk tells me
The lookup table 'debit.csv' requires a .csv or KV store lookup definition.
Here is the csv
https://www.cjoint.com/c/LElp7nHLilB
I have seen this error = "The lookup table 'debit.csv' requires a .csv or KV store lookup definition."
The issue that I encountered was due to the context of where I was running the query from. Check on the lookup table permission. Edit the permission and ensure you have the proper permission set. Make sure you are granting the appropriate permission for the specific app, or all apps, or private.
When I encountered this error it was due to me having the permission set to private and I was searching in a different app. I changed the permission from private to the app and I'm able to view the lookup table and no longer get this error message. Hope this helps.
Looks like you need to address that error! 😀
What do you mean exactly ?
Thoroughly check your definitions to see if everything is correct - you could try recreating the key store to see if that fixes your issue.
I done it and now | inputlookup deb.csv works fine
But when I run my searches the lookup doesnt works with 2 different case
If I run this, I have no error but the csv is not taken into account
| lookup deb.csv sam espace as site output entite debit
| stats last(site) as "Espace" by sam
And if I run this, I have the message "Error in 'lookup' command: Could not construct lookup"
| lookup deb.csv espace as site output entite debit sam
| stats last(site) as "Espace" by sam
There is no empty fields in the csv
https://www.cjoint.com/c/LElp7nHLilB
What is wrong please?
sam doesn't exist in the csv list you provided but I suspect that's just a typo as you would have got a different error otherwise.
How big is your csv file?
What does the job inspector report?
sam is the CSV example correspond to "s" field
the csv size is 4 ko
here is some info from the job inspector
Can you complete the picture with the search or at least the line you used in the search which is giving you this error?
Hi @jip31,
did you created the lookup definition? {settings -- Lookups -- Lookup Definitions]
Ciao.
Giuseppe
hello
yes
Hi
Here is the csv
and the search
| lookup deb.csv entite as site output s espace
| stats last(site) as site, last(espace) as espace by s