Splunk Search

Unable to use lookup

thirumalreddyb
Communicator

I have a problem, I configured a lookup table, defined it and set automatic lookup. When i tried to run a simple command sourcetype=csv-20
The error shows "Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'csv-20' and lookup table 'sample_lookups'."
Please correct me if i'm missing something in the configurations.
Note:There are no hidden characters in the lookup file.

props.conf

[csv-20]
KV_MODE = none
REPORT-AutoHeader = AutoHeader-6
SHOULD_LINEMERGE = False
given_type = csv
pulldown_type = true
CHECK_FOR_HEADER = False
LOOKUP-sample_lookups = sample_lookups productId OUTPUTNEW price, description

transforms.conf

[sample_lookups]
filename = sample_lookups.csv

Input file

A1,3
A2,2
A3,7
A4,8
A5,9

Lookup table

productId,price,description
A1,10.0,Bathing_Bar
A2,12.25,Tooth_brush
A3,6.5,Tooth_paste
A4,7.96,deo
A5,12.5,Mars_choco

Tags (1)
0 Karma
1 Solution

linu1988
Champion

I guess you have mentioned the column name "productId" in your input file. Rest of the things are correctly done.

"|inputcsv input.csv|lookup sample_lookups productId" is giving you the desired result

View solution in original post

linu1988
Champion

I guess you have mentioned the column name "productId" in your input file. Rest of the things are correctly done.

"|inputcsv input.csv|lookup sample_lookups productId" is giving you the desired result

linu1988
Champion

could you write me the query where you are using sourcetype? i may be able to help!

0 Karma

thirumalreddyb
Communicator

" |inputlookup sample_lookups" command retrieves me with the lookup table with three columns.

But when i run "sourcetype=csv-20" command; the error still shows up.
"Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'csv-20' and lookup table 'sample_lookups'."

0 Karma
Get Updates on the Splunk Community!

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Combine Multiline Logs into a Single Event with SOCK: a Step-by-Step Guide for ...

Combine multiline logs into a single event with SOCK - a step-by-step guide for newbies Olga Malita The ...

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...