Splunk Search

Unable to use lookup

thirumalreddyb
Communicator

I have a problem, I configured a lookup table, defined it and set automatic lookup. When i tried to run a simple command sourcetype=csv-20
The error shows "Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'csv-20' and lookup table 'sample_lookups'."
Please correct me if i'm missing something in the configurations.
Note:There are no hidden characters in the lookup file.

props.conf

[csv-20]
KV_MODE = none
REPORT-AutoHeader = AutoHeader-6
SHOULD_LINEMERGE = False
given_type = csv
pulldown_type = true
CHECK_FOR_HEADER = False
LOOKUP-sample_lookups = sample_lookups productId OUTPUTNEW price, description

transforms.conf

[sample_lookups]
filename = sample_lookups.csv

Input file

A1,3
A2,2
A3,7
A4,8
A5,9

Lookup table

productId,price,description
A1,10.0,Bathing_Bar
A2,12.25,Tooth_brush
A3,6.5,Tooth_paste
A4,7.96,deo
A5,12.5,Mars_choco

Tags (1)
0 Karma
1 Solution

linu1988
Champion

I guess you have mentioned the column name "productId" in your input file. Rest of the things are correctly done.

"|inputcsv input.csv|lookup sample_lookups productId" is giving you the desired result

View solution in original post

linu1988
Champion

I guess you have mentioned the column name "productId" in your input file. Rest of the things are correctly done.

"|inputcsv input.csv|lookup sample_lookups productId" is giving you the desired result

linu1988
Champion

could you write me the query where you are using sourcetype? i may be able to help!

0 Karma

thirumalreddyb
Communicator

" |inputlookup sample_lookups" command retrieves me with the lookup table with three columns.

But when i run "sourcetype=csv-20" command; the error still shows up.
"Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'csv-20' and lookup table 'sample_lookups'."

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...