Hi,
When configuring the lookup table, i receive the following error The lookup table 'xxxx' does not exist. It is referenced by configuration 'yyyyy'.
index=main sourcetype=yyyy [|inputlookup xxxx.csv |fields account_name] | chart count(username) by username
The objective of is to find a list of accounts listed in xxxx.csv field and count the number of time the user login from the sourcetype yyyy.
Please advise what could be the error
Hi florencegoh,
It seems to be permission issue.
so include Below Stanza in metadata>default.meta -
[props/<sourcetype_name>/LOOKUP-<Automatic_Lookup_Name>]
export = none
Hi,
where do you configure that ? New to it.
Regards,
You can add that stanza in file "default.meta" present inside metadata folder
Did you check permission of lookup table?? If you fire following query are you getting any output??
|inputlookup xxx.csv
I would suggest that you use lookup command instead of inputlookup, for example
index=main sourcetype=yyyy |lookup xxxx.csv username output account_name | chart count(username) by username
Getting the outputs of the table when running "|inputlookup.csv.
I have run that suggested command. but still getting the error as "could not find all the specified lookup fields in the lookup table".
Any suggestion ?
Can you confirm presence of the column "account_name" in your lookup file which is extracted from lookup file?
IS lookup table 'xxxx' is automatic lookup?