https://community.splunk.com/t5/Splunk-Search/CSV-lookups-failing/m-p/92372#M23843 <P>Is the field extraction correct in all the events? If the field extraction is working properly for only some of the events, the lookup would work only for those events.</P> <PRE><CODE>yoursearchhere | lookupcmdhere </CODE></PRE> <P>Run this in verbose mode. Choose "select and show in results" for the Name and Id fields, so that the fields show up beneath the events. This may show you what is going wrong...</P> Thu, 11 Jul 2013 22:59:19 GMT lguinn2 2013-07-11T22:59:19Z https://community.splunk.com/t5/Splunk-Search/CSV-lookups-failing/m-p/92371#M23842 <P>Hi,</P> <P>We have a CSV file containing names and ids. Same name can be present for multiple ids.</P> <PRE><CODE>Name Id A 1 B 2 B 20 B 200 C 3 D 78 E 4 E 34 E 57 F 100 </CODE></PRE> <P>In logs we get Id. We lookup CSV file and get Name and summarize this data. right now our logs contain only id 2 and 4.<BR /> Assume that there are 100 events in a time span which we are summarizing. The lookup fails for some events even though it is the same id for which the lookup was successful. Sometimes it works and sometimes it fails. We see null values for Name field in our summary index.</P> <P>Under what circumstances the lookup fails? The search is scheduled and it runs at scheduled time.</P> <P>Thanks</P> <P>Strive</P> Thu, 11 Jul 2013 14:22:54 GMT https://community.splunk.com/t5/Splunk-Search/CSV-lookups-failing/m-p/92371#M23842 strive 2013-07-11T14:22:54Z https://community.splunk.com/t5/Splunk-Search/CSV-lookups-failing/m-p/92372#M23843 <P>Is the field extraction correct in all the events? If the field extraction is working properly for only some of the events, the lookup would work only for those events.</P> <PRE><CODE>yoursearchhere | lookupcmdhere </CODE></PRE> <P>Run this in verbose mode. Choose "select and show in results" for the Name and Id fields, so that the fields show up beneath the events. This may show you what is going wrong...</P> Thu, 11 Jul 2013 22:59:19 GMT https://community.splunk.com/t5/Splunk-Search/CSV-lookups-failing/m-p/92372#M23843 lguinn2 2013-07-11T22:59:19Z