Why am I receiving this lookup error?

[jip31]

hi

When I call the lookup like below it works fine

| inputlookup test.csv

but when I use the lookup in a search I have the message below

Error in 'lookup' command: Could not construct lookup

here is the lookup

 what I have to do please?

[ILoveMangoes99]

No sure if you've resolved this issue yet, but you can try to make sure your csv file is in this format?  The format you have is a coma-delimited, but Splunk lookup table may not like that particular format. So you may want to try to fix the lookup table to make it look like this?  Just sharing my suggestion.  I encountered something that looks similar to this issue.  Hope this helps. 🙂

[jip31]

Is anybody can help please?

[jip31]

Is anybody can help please?

[jip31]

is anybody can explain me what is wrong in my csv please?

[ITWhisperer]

Have you tried using "AS" instead of "as" in your lookup command?

[jip31]

it changes nothing, same message and same result

If you look at the error message, i think the csv is not interpreted correctly because you can see the fields are not separated correctly

Could not construct lookup 'debit.csv, entite, AS, site, output, sam, espace

But I dont understand what is wrong because when I am doing | inputlookup debit.csv, the data are correctly displayed

[ITWhisperer]

What do you get when you do this:

| inputlookup deb.csv

[jip31]

At the beginning it was working but when I executed the search, I did have the message below

Error in 'lookup' command: Could not construct lookup

 But now when I try to upload the file, Splunk tells me

The lookup table 'debit.csv' requires a .csv or KV store lookup definition.

Here is the csv

https://www.cjoint.com/c/LElp7nHLilB

[ILoveMangoes99]

I have seen this error = "The lookup table 'debit.csv' requires a .csv or KV store lookup definition."

The issue that I encountered was due to the context of where I was running the query from.   Check on the lookup table permission.  Edit the permission and ensure you have the proper permission set.  Make sure you are granting the appropriate permission for the specific app, or all apps, or private.  

When I encountered this error it was due to me having the permission set to private and I was searching in a different app.  I changed the permission from private to the app and I'm able to view the lookup table and no longer get this error message.  Hope this helps.

[ITWhisperer]

Looks like you need to address that error! 😀

[jip31]

What do you mean exactly ?

[ITWhisperer]

Thoroughly check your definitions to see if everything is correct - you could try recreating the key store to see if that fixes your issue.

[jip31]

I done it and now | inputlookup deb.csv works fine

But when I run my searches the lookup doesnt works with 2 different case

If I run this, I have no error but the csv is not taken into account

| lookup deb.csv sam espace as site output entite debit
| stats last(site) as "Espace" by sam 

 And if I run this, I have the message "Error in 'lookup' command: Could not construct lookup"

| lookup deb.csv espace as site output entite debit sam
| stats last(site) as "Espace" by sam 

 There is no empty fields in the csv

https://www.cjoint.com/c/LElp7nHLilB

What is wrong please?

[ITWhisperer]

sam doesn't exist in the csv list you provided but I suspect that's just a typo as you would have got a different error otherwise.

How big is your csv file?

What does the job inspector report?

[jip31]

sam is the CSV example correspond to "s" field

the csv size is 4 ko

here is some info from the job inspector

[ITWhisperer]

Can you complete the picture with the search or at least the line you used in the search which is giving you this error?

[gcusello]

Hi @jip31,

did you created the lookup definition? {settings -- Lookups -- Lookup Definitions]

Ciao.

Giuseppe

[jip31]

hello

yes

[gcusello]

Hi @jip31,

could you share your search and the conf files containing the lookup?

Ciao.

Giuseppe

[jip31]

Hi

Here is the csv

and the search

| lookup deb.csv entite as site output s espace
| stats last(site) as site, last(espace) as espace by s