I'm getting this error after installing the servicenow TA and app and not sure why. I've pulled out the relevant snips targeting the error. I've also cat'ed the lookup to see if there's any odd characters in there and didn't find any.
Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'snow:em_event' and lookup table 'severity_lookup'.
[snow:em_event]
EXTRACT-snow_em_event_alert = alert="(?P[^\s"]*)"
For display_value = all, uncomment the following.
FIELDALIAS-severity_name = dv_severity AS severity_name
For display_value = all, comment the following.
LOOKUP-severity_name = severity_lookup severity AS severity OUTPUTNEW severity_$
[severity_lookup]
filename = severity.csv
severity,severity_name
0,Clear
1,Critical
2,Major
3,Minor
4,Warning
[root@[host]lookups]# cat severity.csv
severity,severity_name
0,Clear
1,Critical
2,Major
3,Minor
4,Warning
Your props look all mangled. Here is my copy:
[snow:em_event]
EXTRACT-snow_em_event_alert = alert="(?P<snow_em_event_alert>[^\s"]*)"
# For display_value = all, uncomment the following.
#FIELDALIAS-severity_name = dv_severity AS severity_name
# For display_value = all, comment the following.
LOOKUP-severity_name = severity_lookup severity AS severity OUTPUTNEW severity_name AS severity_name
I would suggest reinstalling the addon.
http://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Troubleshooting. Please configure lookup as per your SNOW instance for events or disable lookup. ,Add on does variety of lookup. The current lookup list might have to be modified for the values used in your SNOW system. I think the documentation clearly outlines this part. http://docs.splunk.com/Documentation/AddOns/released/ServiceNow/Troubleshooting
bump. Anyone suggestions?