All Apps and Add-ons

Lookup tables aren't building

jasondell
New Member

We are running through the process and are having an issue with the lookup csv files. Even though the jobs for building the lookups finish our counts are still very low. I checked the size of the csv files and the ones on question are more than 40meg and contain more than 10,000 rows but, for example, the Computer lookup is only returning around 1175 entries when we run a inputlookup against it. Where should I go from here - I have tried running through the build AD Lookup List process multiple times without success.

0 Karma

macadminrohit
Contributor

So the Computer lookup is the one which has more than 10,000 rows and inputlookup shows only 1175 ? Generally if inputlookup is not showing any data then it could be a permission issue.

0 Karma

jasondell
New Member

I don't think it is a permissions issue although I do appreciate the feedback. I am in the admin role in the environment.

0 Karma

sdchakraborty
Contributor

Hi,

Can you try with KV store lookup. Generally csv lookups are not good for huge volume and frequently updated data.

Sid

0 Karma

jasondell
New Member

Unfortunately, I am not building the lookups. The MS Windows AD Object app is building them. It is suppose to handle 10s of thousands of entries and the lookup files contain that many entries but inputlookup is only returning a subset of rows. I have tried this for the Users, Computers, and Groups and they are all returning only a subset of data from the CSV files.

0 Karma

sdchakraborty
Contributor

Ahh I got it...can you add the max input to the input lookup command...Like

| inputlookup max=0

Let me know if it resolves.

Sid

0 Karma

jasondell
New Member

I figured out the issue. Looks like someone tried to get the app working before me and they made copies of the csv files to another location that precedes the location in question so it was returning that data. I renamed those files and everything is working now. Thanks for the suggestions.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...