Splunk Search

lookup table problem

my_splunk
Path Finder

I have already used lookup table with splunk 4.3 and i have never had problems.
With 5.0.1 i have a strange problem.
I have this in my ../etc/apps/search/local/props.conf file

[mycsv]
LOOKUP-calendar = calendar month OUTPUTNEW my_month

and in ../etc/apps/search/local/transforms.conf file

[calendar]
filename = calendar.csv

where calendar is in ../etc/apps/search/local/lookups

In manager console i have put lookup definition and lookup file objects to global.
At search time i have this error:
The lookup table 'calendar' does not exist. It is referenced by configuration 'mycsv'.

Can you healp me?

Thanks

Tags (1)
0 Karma

Ayn
Legend

You've put the csv file in the wrong location. It shouldn't be in etc/apps/search/local/lookups, it should be in a lookups directory directly under the app root, i.e. etc/apps/search/lookups.

Ayn
Legend

Did you restart Splunk after editing the configuration files?

my_splunk
Path Finder

This is my updating. I have seen that there are many known issues abouk lookup with 5.0.1 version and i think i found another.
When i use directly conf file (props, transforms) splunk do not find lookup definition, in fact in manager console lookup definition is empty. If i use web interface for lookup creation (i mean manager->lookup and then in order lookup file, lookup defition and automatic lookup) there are no problem.
I tjink this is a bug, how can i report it?

0 Karma

my_splunk
Path Finder

as soon as possible i try this same configuration in 4.3 splunk....

0 Karma

Ayn
Legend

I don't know, sorry - your conf looks OK to me.

0 Karma

my_splunk
Path Finder

Sorry, i have wrote a wrong thing in my post.
I have correctly put csv file in etc/apps/search/lookups
So why this error at search time?

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...