Refine your search:

Is this a permissions bug? I can | inputlookup with no search only by filename, not table name in transforms.conf. When all the related files are moved into the search app, the issue goes away.

In app A transforms.conf:
[userlist]
filename = userstats.csv

I used | outputlookup userlist from the Search app to successfully write 200 lines to the file.

Now, I try using inputlookup to read from the file:
search | inputlookup append=t userlist - works
search | inputlookup append=t userstats.csv - works
| inputlookup userstats.csv - works
| inputlookup userlist - fails

Error is Error in 'inputlookup' command: The lookup table 'userlist' is invalid.

I also got an error when trying to run a savedsearch using search ... | inputlookup append=t userlist | outputlookup userlist via the manager -> Saved Searches -> Run.

App A default.meta is:
[]
access = read : [ * ], write : [ admin, power ]
export = system)

asked 05 Oct '10, 15:55

Jason's gravatar image

Jason
2.0k25
accept rate: 49%

edited 05 Oct '10, 16:11

1

is the ")" after the word "system" just a typo, or is it in your default.meta file that way?

(05 Oct '10, 17:37) Lowell ♦
Be the first one to answer this question!
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×335
×39

Asked: 05 Oct '10, 15:55

Seen: 507 times

Last updated: 05 Oct '10, 16:11

Copyright © 2005-2012 Splunk, Inc. All rights reserved.