Went through the wizard to create a new DB Lookup in Splunk DB Connect 2.3.1. All the previews work fine during the creation process, the "Preview Your Lookup" step indicates that this should work exactly as intended.
The lookup never enriches our events, though, and any searches result in this error from all of our indexers:
[indexer] Script for lookup table 'db_connect_mylookup' returned error code 1. Results may be incorrect.
Is there a broken step in the lookup creation wizard somewhere, or did we go through it in a way that's causing this lookup to break?
↧