Splunk Search

Empty Lookup Tables - disable warning banner

apgersplunk
New Member

version 6

I maintain a set of csv files as lookup tables and everything works perfectly fine with one exception. If any of the files contain only a header but no data, the views that reference the collection of lookups pastes a yellow warning banner across the UI stating "Empty csv lookup file (contains only a header) for table ...".

Some of the csv files will occasionally be empty by design (header only) and I am trying to figure out how to disable these warnings. Any ideas?

Tags (3)
0 Karma

apgersplunk
New Member

Thanks for the quick reply and good pointer. I tested the logging levels associated with "lookup" and "csv" related channels with no luck. It seems that the handler would have fixed it. I made the test changes through the GUI while troubleshooting.

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi apgersplunk,

you can either set it in log.cfg or in the Manager - System Settings - System logging and change the setting for one of the lookup channels. Available channels are:

  • LookupOperator
  • LookupTableConfPathMapper
  • LookupTablesHandler

hope this helps ...

cheers, MuS

MuS
SplunkTrust
SplunkTrust

another thought just came up my head...you can disable/modify the message bar in the XML of your views as well ..... but, this is dangerzone, because you can set it to be too strict and you will also NOT receive any other message as well (like license violations)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...