Splunk Dev

Lookup table does not exist . It is referenced by configuration 'yyyy'

florencegoh
New Member

Hi,
When configuring the lookup table, i receive the following error The lookup table 'xxxx' does not exist. It is referenced by configuration 'yyyyy'.
index=main sourcetype=yyyy [|inputlookup xxxx.csv |fields account_name] | chart count(username) by username

The objective of is to find a list of accounts listed in xxxx.csv field and count the number of time the user login from the sourcetype yyyy.

Please advise what could be the error

Tags (1)
0 Karma

493669
Super Champion

Hi florencegoh,
It seems to be permission issue.
so include Below Stanza in metadata>default.meta -

[props/<sourcetype_name>/LOOKUP-<Automatic_Lookup_Name>]
export = none
0 Karma

florencegoh
New Member

Hi,
where do you configure that ? New to it.

Regards,

0 Karma

493669
Super Champion

You can add that stanza in file "default.meta" present inside metadata folder

0 Karma

hardikJsheth
Motivator

Did you check permission of lookup table?? If you fire following query are you getting any output??

|inputlookup xxx.csv

I would suggest that you use lookup command instead of inputlookup, for example

index=main sourcetype=yyyy |lookup xxxx.csv username output  account_name | chart count(username) by username
0 Karma

florencegoh
New Member

Getting the outputs of the table when running "|inputlookup.csv.

I have run that suggested command. but still getting the error as "could not find all the specified lookup fields in the lookup table".

Any suggestion ?

0 Karma

hardikJsheth
Motivator

Can you confirm presence of the column "account_name" in your lookup file which is extracted from lookup file?

0 Karma

493669
Super Champion

IS lookup table 'xxxx' is automatic lookup?

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...