Splunk Search

Why is my lookup search returning error "All of the fields in the lookup table are specified as lookups, leaving no destination fields"?

shanesmith30286
New Member

Hello All,

I am a Splunk noob, and I am trying to make a lookup work. Specifically, I am creating a lookup table of IP addresses, which I then want to compare to my outbound firewall connections which target the IPs in the lookup.

Sample from the lookup CSV (file named bad_guys.csv):

Mal_IPs,
12.34.56.78,
22.33.44.55,

Sample Search:

sourcetype="cisco:asa" [lookup bad_guys.csv Mal_IPs as dest_ip]

When I run this search, I get the following error:

Error in 'lookup' command: All of the fields in the lookup table are specified as lookups, leaving no destination fields.

Pretty sure I am doing something bone-headed, but can't seem to figure out what it is. Any ideas? Thanks in advance!

0 Karma

jstoner_splunk
Splunk Employee
Splunk Employee

Not a bone-headed question, there is a fix and what you did was what I started off doing as well.

The challenge is that when using the lookup command with a lookup that has a single value in it, you need to have an OUTPUT defined otherwise, it does not have anything to show for the lookup that it performed.

In your case, | lookup bad_guys.csv Mal_IPs as dest_ip OUTPUT Mal_IPs is what I would probably do.

Keep in mind, that will return all relevant rows in the search whether or not a match occurs. The next line under my lookup would likely be | search Mal_IPs=* which will just return values that have a Mal_IPs in it, those will be the matches.

There are other ways of doing this as well but hopefully this gets you going in the right direction.

MuhammadAbdelAa
New Member

Thanks 🙂

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...