Splunk Search

lookup not found errors

robgreen
Path Finder

i have yet to get lookups to work correctly in an app.

The file is in the right place

/opt/splunk/etc/apps/myapp/lookups

[root@splunkui111 lookups]# ls -ltr
-rw-r--r-- 1 root root 22220462 Dec 13 18:13 nanpa-sorta-nothousands.csv

i have it in my props.conf

[hosted_file]
LOOKUP-npanxx = npanxx NPA NXX OUTPUTS City, State, LATA, CLLI, Company, OCN, SwitchType, SwitchName, PrefixType, Ratecenter

and in my transforms.conf

[npanxx]
filename=nanpa-sorta-nothousands.csv

If i look at /opt/splunk/var/run/searchpeers/splunkui111-1324253269
i can see the file is there

[root@splunk111 lookups]# ls -ltr
total 21700
-rw-r--r-- 1 root root 22220462 Dec 19 00:07 nanpa-sorta-nothousands.csv
[root@splunk111 lookups]# pwd
/opt/splunk/var/run/searchpeers/splunkui111-1324253269/apps/myapp/lookups

I have separate servers from the indexer and the search heads so i am assuming i am suppose to put on the SH but i have also tried each indexer.

Am i missing a file permission issue/owner/group issue here? i get errors in the message area at the top for all searches and manually trying to do the lookup also fails.

rob

Tags (2)
0 Karma
1 Solution

dwaddle
SplunkTrust
SplunkTrust

Are you doing your searches that use the lookup from within the app that the lookup is defined in? Or, are you doing them from the search app? You might need to export the lookup to all apps.

View solution in original post

0 Karma

dwaddle
SplunkTrust
SplunkTrust

Are you doing your searches that use the lookup from within the app that the lookup is defined in? Or, are you doing them from the search app? You might need to export the lookup to all apps.

0 Karma

Paolo_Prigione
Builder

Aside of this, in case you will have lookups updated by scheduled searches with the outputlookup command, keep the filename and transforms stanza name consistent (i.e. the same, except for the .csv extensions). I experienced some misbehaviour when the names were not identical

0 Karma

robgreen
Path Finder

that was it.. that explains why it worked when i put in the /etc/system/local folder.

thanks

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...