Splunk Search

Why is my lookup search returning error "All of the fields in the lookup table are specified as lookups, leaving no destination fields"?

shanesmith30286
New Member

Hello All,

I am a Splunk noob, and I am trying to make a lookup work. Specifically, I am creating a lookup table of IP addresses, which I then want to compare to my outbound firewall connections which target the IPs in the lookup.

Sample from the lookup CSV (file named bad_guys.csv):

Mal_IPs,
12.34.56.78,
22.33.44.55,

Sample Search:

sourcetype="cisco:asa" [lookup bad_guys.csv Mal_IPs as dest_ip]

When I run this search, I get the following error:

Error in 'lookup' command: All of the fields in the lookup table are specified as lookups, leaving no destination fields.

Pretty sure I am doing something bone-headed, but can't seem to figure out what it is. Any ideas? Thanks in advance!

0 Karma

jstoner_splunk
Splunk Employee
Splunk Employee

Not a bone-headed question, there is a fix and what you did was what I started off doing as well.

The challenge is that when using the lookup command with a lookup that has a single value in it, you need to have an OUTPUT defined otherwise, it does not have anything to show for the lookup that it performed.

In your case, | lookup bad_guys.csv Mal_IPs as dest_ip OUTPUT Mal_IPs is what I would probably do.

Keep in mind, that will return all relevant rows in the search whether or not a match occurs. The next line under my lookup would likely be | search Mal_IPs=* which will just return values that have a Mal_IPs in it, those will be the matches.

There are other ways of doing this as well but hopefully this gets you going in the right direction.

MuhammadAbdelAa
New Member

Thanks 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...