Splunk Search

Lookup Table

Abha
Explorer

I am attempting to use an external lookup table against some twitter data.

My Transforms.conf file reads:
[HLookup]
filename = HLookup.csv

Props.conf reads:
[source_type_w]
LOOKUP-HLookup = HLookup w AS word OUTPUT|OUTPUTNEW e

I however get the error:
Could not find all of the specified lookup fields in the lookup table.' for conf 'source_type_w' and lookup table 'HLookup'.

I am at my wits end as to why this is happening.It looks simple enough 😞

Tags (1)

lguinn2
Legend

You have to pick either OUTPUT or OUTPUTNEW - you can't have both. For example:

[source_type_w]
LOOKUP-HLookup = HLookup w AS word OUTPUTNEW e

This setup also implies that the csv file starts with a header that looks like this:

w,e

Abha
Explorer

Thanks! 🙂

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...