Splunk Search

how to use universal source type for lookup a multiple indexs

linu1988
Champion

I want to use two lookups where the logged in user roles are input to the 1st lookup and the 2nd lookup is fed by the result of 1st look up. But while implementing at the server i am getting "could not find fields for lookup table , conf missing the relevant fields error. Can any body help in this?

First Csv contains Second Csv Contains

Roles,Server Server,tier
admin,A A,C
User,B B,D

Tags (2)
0 Karma
1 Solution

Ayn
Legend

You're using the lookup command wrong. You're specifying "Role as roles", but it should be the other way around - "roles as Role" (and same thing for the other lookup).

View solution in original post

0 Karma

Ayn
Legend

You're using the lookup command wrong. You're specifying "Role as roles", but it should be the other way around - "roles as Role" (and same thing for the other lookup).

0 Karma

linu1988
Champion

Thanks for the explanation Ayn, With some modifications it started working. 🙂

0 Karma

linu1988
Champion

Ayn, the lookups used contain the fields which are being called from search query. its defined like "| rest /services/authentication/users | lookup samplelookup Role as roles | fields Server| mvexpand Server | Lookup mytiers Servers as Server". Any suggessions on the implementation?

0 Karma

linu1988
Champion

i have modified the transforms.conf and props.conf to define the lookup table and definition

SO definition goes like this

[tiers]
Lookup-sample=mylookup Roles OUTPUT Server
Lookup-tier=mytiers Server OUTPUT tier

I am getting the result but when it is applied on different indexed data, i getting Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'tiers' and lookup table 'samplelookup'.

I am using the Rest api to get the user roles then i am looking up for the relevant fields to populate the dropdown from the results

0 Karma

Ayn
Legend

When you call it on different indexed data, exactly how are you calling it? Because the error message really says it - you're telling it to use lookup fields that don't exist in the lookups you're calling.

0 Karma

Ayn
Legend

More details please. What do your config files look like? How are you calling your lookups?

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...