Splunk Search

Lookup Table

Abha
Explorer

I am attempting to use an external lookup table against some twitter data.

My Transforms.conf file reads:
[HLookup]
filename = HLookup.csv

Props.conf reads:
[source_type_w]
LOOKUP-HLookup = HLookup w AS word OUTPUT|OUTPUTNEW e

I however get the error:
Could not find all of the specified lookup fields in the lookup table.' for conf 'source_type_w' and lookup table 'HLookup'.

I am at my wits end as to why this is happening.It looks simple enough 😞

Tags (1)

lguinn2
Legend

You have to pick either OUTPUT or OUTPUTNEW - you can't have both. For example:

[source_type_w]
LOOKUP-HLookup = HLookup w AS word OUTPUTNEW e

This setup also implies that the csv file starts with a header that looks like this:

w,e

Abha
Explorer

Thanks! 🙂

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...