topic When use outputlookup, the result is output in incomplete state. in Splunk Search

When use outputlookup, the result is output in incomplete state.

yutaka1005 — Fri, 13 Jul 2018 06:04:42 GMT

Splunk ver : 6.2.7
OS : CentOS 7

I'm trying outputlookup some lookup files from one lookup file.
Below is the source lookup file.
*In fact there are more fields and values.

master.csv

host, flag
AAA, 1
BBB, 1
CCC, 1

The following is a search statement used to split and output the lookup file.

| inputlookup master.csv | search host="AAA" | outputlookup AAA.csv

| inputlookup master.csv | search host="BBB" | outputlookup BBB.csv

| inputlookup master.csv | search host="CCC" | outputlookup CCC.csv

However when I check lookup files that made by outputlookup, the value of the field flag become null!

Does anyone face such an event?
Also, if you know the solution etc, I would be pleased if you could tell me.

Re: When use outputlookup, the result is output in incomplete state.

HiroshiSatoh — Fri, 13 Jul 2018 06:14:48 GMT

フィールド名が間違っているということはないですか？
例えばflagの先頭にスペースが入っているとか

Re: When use outputlookup, the result is output in incomplete state.

yutaka1005 — Fri, 13 Jul 2018 06:16:55 GMT

flagフィールドに関しては、元lookupファイルからそのままoutputしているので、特にフィールド名による影響は関連が無いかと思います。