I have already used lookup table with splunk 4.3 and i have never had problems.
With 5.0.1 i have a strange problem.
I have this in my ../etc/apps/search/local/props.conf file
[mycsv]
LOOKUP-calendar = calendar month OUTPUTNEW my_month
and in ../etc/apps/search/local/transforms.conf file
[calendar]
filename = calendar.csv
where calendar is in ../etc/apps/search/local/lookups
In manager console i have put lookup definition and lookup file objects to global.
At search time i have this error:
The lookup table 'calendar' does not exist. It is referenced by configuration 'mycsv'.
Can you healp me?
Thanks
You've put the csv file in the wrong location. It shouldn't be in etc/apps/search/local/lookups
, it should be in a lookups directory directly under the app root, i.e. etc/apps/search/lookups
.
Did you restart Splunk after editing the configuration files?
This is my updating. I have seen that there are many known issues abouk lookup with 5.0.1 version and i think i found another.
When i use directly conf file (props, transforms) splunk do not find lookup definition, in fact in manager console lookup definition is empty. If i use web interface for lookup creation (i mean manager->lookup and then in order lookup file, lookup defition and automatic lookup) there are no problem.
I tjink this is a bug, how can i report it?
as soon as possible i try this same configuration in 4.3 splunk....
I don't know, sorry - your conf looks OK to me.
Sorry, i have wrote a wrong thing in my post.
I have correctly put csv file in etc/apps/search/lookups
So why this error at search time?