https://community.splunk.com/t5/Splunk-Search/Automatic-Lookup-matching-on-multivalue-not-working/m-p/642315#M222499 <P>I'm trying to configure an automatic lookup and match multivalue field of IP addresses (in the lookup) on an IP field (in the SPL results). The lookup is a KV Store, and the definition targets that collection.</P> <P>When I run the lookup definition manually, it works fine.</P> <PRE>index=my_index eventtype=my_event_type<BR />| lookup lookup_definition ip_mv AS ip OUTPUTNEW dns</PRE> <P>However, when I create an automatic lookup using the same information, it doesn't work.</P> <P>Any ideas?</P> Thu, 04 May 2023 15:55:19 GMT ejwade 2023-05-04T15:55:19Z https://community.splunk.com/t5/Splunk-Search/Automatic-Lookup-matching-on-multivalue-not-working/m-p/642315#M222499 <P>I'm trying to configure an automatic lookup and match multivalue field of IP addresses (in the lookup) on an IP field (in the SPL results). The lookup is a KV Store, and the definition targets that collection.</P> <P>When I run the lookup definition manually, it works fine.</P> <PRE>index=my_index eventtype=my_event_type<BR />| lookup lookup_definition ip_mv AS ip OUTPUTNEW dns</PRE> <P>However, when I create an automatic lookup using the same information, it doesn't work.</P> <P>Any ideas?</P> Thu, 04 May 2023 15:55:19 GMT https://community.splunk.com/t5/Splunk-Search/Automatic-Lookup-matching-on-multivalue-not-working/m-p/642315#M222499 ejwade 2023-05-04T15:55:19Z https://community.splunk.com/t5/Splunk-Search/Automatic-Lookup-matching-on-multivalue-not-working/m-p/645181#M223412 <P>I discovered the issue. KV store collections need to be replicated to leverage automatic lookups.</P><P><A href="https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Makeyourlookupautomatic#Enable_replication_for_a_KV_store_collection" target="_blank" rel="noopener">https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Makeyourlookupautomatic#Enable_replication_for_a_KV_store_collection</A></P> Wed, 31 May 2023 03:03:28 GMT https://community.splunk.com/t5/Splunk-Search/Automatic-Lookup-matching-on-multivalue-not-working/m-p/645181#M223412 ejwade 2023-05-31T03:03:28Z