Hi,
I'm having an issue with a splunk lookup and I can't work out what the issue is. I have a lookup file, that among other things contains a mac address field and a hostname field
mac, nt_host
aabbccddeeff, machine1
a1b1c1d1e1f1, machine2
etc.
I then have a search which returns data like the following:
MAC: AA:BB:CC:DD:EE:FF
interface: ge-X/X/XX
switch: SWITCHNAME
timestamp: 2019-10-14T09:02:02+00:00
I'm trying to match the mac in the lookup table and return the nt_host:
index=os source="logfile" host="logfilehost"
| eval mac = lower(trim(replace(MAC, ":", "")))
| lookup lookupfile mac OUTPUT nt_host
But I get the following error:
Streamed search execute failed because: Error in 'lookup' command: Could not construct lookup 'lookupfile, mac, OUTPUT, dns'. See search.log for more details..
If i run this search it works:
index=os source="logfile" host="logfilehost"
| eval mac = lower(trim(replace(MAC, ":", "")))
| table mac
| lookup lookupfile mac OUTPUT nt_host
but a subsequent stats command then returns the same error again. I'm unsure whats happening here and I see no errors in the search log.
No idea what I'm missing here.
Thanks
↧