https://community.splunk.com/t5/Splunk-Search/lookup-not-working-Help-pls/m-p/571783#M199247 <P>Now working lookup&nbsp;</P><P>On a local server on my computer, I got the result</P><P>&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Снимок экрана 2021-10-21 в 13.58.17.png" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/16524i80004001C490ED5E/image-size/large?v=v2&amp;px=999" role="button" title="Снимок экрана 2021-10-21 в 13.58.17.png" alt="Снимок экрана 2021-10-21 в 13.58.17.png" /></span></P><P>But when I did exactly the same actions on the production server. one to one. Then there is no result</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Снимок экрана 2021-10-21 в 13.02.34.png" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/16521i45D8B02C02532010/image-size/large?v=v2&amp;px=999" role="button" title="Снимок экрана 2021-10-21 в 13.02.34.png" alt="Снимок экрана 2021-10-21 в 13.02.34.png" /></span><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Снимок экрана 2021-10-21 в 13.03.09.png" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/16523iB4E477AF0628A9D3/image-size/large?v=v2&amp;px=999" role="button" title="Снимок экрана 2021-10-21 в 13.03.09.png" alt="Снимок экрана 2021-10-21 в 13.03.09.png" /></span><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Снимок экрана 2021-10-21 в 13.03.31.png" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/16522i108AC25B9493F472/image-size/large?v=v2&amp;px=999" role="button" title="Снимок экрана 2021-10-21 в 13.03.31.png" alt="Снимок экрана 2021-10-21 в 13.03.31.png" /></span></P><P>&nbsp;</P><P>examples in the photo, one user at a time. no result for everyone.<BR />where could i go wrong? Thanks!&nbsp;<BR /><BR />Splunk Version 7.&nbsp;</P><P>both files have global mode</P><P>&nbsp;</P> Thu, 21 Oct 2021 10:59:44 GMT gitingua 2021-10-21T10:59:44Z https://community.splunk.com/t5/Splunk-Search/lookup-not-working-Help-pls/m-p/571783#M199247 <P>Now working lookup&nbsp;</P><P>On a local server on my computer, I got the result</P><P>&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Снимок экрана 2021-10-21 в 13.58.17.png" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/16524i80004001C490ED5E/image-size/large?v=v2&amp;px=999" role="button" title="Снимок экрана 2021-10-21 в 13.58.17.png" alt="Снимок экрана 2021-10-21 в 13.58.17.png" /></span></P><P>But when I did exactly the same actions on the production server. one to one. Then there is no result</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Снимок экрана 2021-10-21 в 13.02.34.png" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/16521i45D8B02C02532010/image-size/large?v=v2&amp;px=999" role="button" title="Снимок экрана 2021-10-21 в 13.02.34.png" alt="Снимок экрана 2021-10-21 в 13.02.34.png" /></span><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Снимок экрана 2021-10-21 в 13.03.09.png" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/16523iB4E477AF0628A9D3/image-size/large?v=v2&amp;px=999" role="button" title="Снимок экрана 2021-10-21 в 13.03.09.png" alt="Снимок экрана 2021-10-21 в 13.03.09.png" /></span><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Снимок экрана 2021-10-21 в 13.03.31.png" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/16522i108AC25B9493F472/image-size/large?v=v2&amp;px=999" role="button" title="Снимок экрана 2021-10-21 в 13.03.31.png" alt="Снимок экрана 2021-10-21 в 13.03.31.png" /></span></P><P>&nbsp;</P><P>examples in the photo, one user at a time. no result for everyone.<BR />where could i go wrong? Thanks!&nbsp;<BR /><BR />Splunk Version 7.&nbsp;</P><P>both files have global mode</P><P>&nbsp;</P> Thu, 21 Oct 2021 10:59:44 GMT https://community.splunk.com/t5/Splunk-Search/lookup-not-working-Help-pls/m-p/571783#M199247 gitingua 2021-10-21T10:59:44Z https://community.splunk.com/t5/Splunk-Search/lookup-not-working-Help-pls/m-p/571813#M199263 <P>The screenshots do not show the lookup file containing an address or CIDR range that matches 10.10.10.10.&nbsp; Is there such an entry?</P> Thu, 21 Oct 2021 13:07:45 GMT https://community.splunk.com/t5/Splunk-Search/lookup-not-working-Help-pls/m-p/571813#M199263 richgalloway 2021-10-21T13:07:45Z https://community.splunk.com/t5/Splunk-Search/lookup-not-working-Help-pls/m-p/571828#M199270 <P>Check lookup definition in both places, csv in both places, permissions on both - in both places. Then run the exact same query in both places.</P> Thu, 21 Oct 2021 14:16:07 GMT https://community.splunk.com/t5/Splunk-Search/lookup-not-working-Help-pls/m-p/571828#M199270 efavreau 2021-10-21T14:16:07Z