Splunk Search

Why am I getting search error "The lookup table 'signals' does not exist" after adding a CSV file in my app's lookup folder?

Makinde
New Member

Hello,

I have a custom written app. Actually it's a legit app which I just added a few lines in the props.conf and inputs.conf files to help obtain some other types of logs and extract useful fields in the log.

So far it appears to be working well, however, I had the following line in the props to help make some comparison to a lookup table;

LOOKUP-signals = signals signal_number as sig

I put the lookup file signals.csv in the lookup folder.

However now I get the following error when I do my searches

[WSECP0005] The lookup table 'signals' does not exist. It is referenced by configuration 'linux:audit'.

Any ideas what could be wrong?

Thanks,
Makinde

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You probably forgot to create and/or share a lookup definition called signals referencing the signals.csv file.

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You probably forgot to create and/or share a lookup definition called signals referencing the signals.csv file.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Lookup definitions live in transforms.conf, minimally like this:

[signals]
filename = signals.csv

That should be deployable along with the rest of the app.

0 Karma

Makinde
New Member

Thanks Martin_Mueller.

I realized that after posting the question however this is an App deployed through the deployment manager, how can I create a lookup definition such that it is a part of the App and gets deployed through the deployment manager?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...