topic Lookup definition is outputting incomplete results in Splunk Search

Lookup definition is outputting incomplete results

mbasharat — Wed, 20 Nov 2024 15:14:56 GMT

Hi,

I have a simple search which is using a lookup definition based off of a lookup. This lookup is large. Search has been using this lookup perfectly fine outputting correct results. Since upgrade to below version of Splunk Enterprise, this output is not happening like it used to. Matched output is significantly reduced resulting in NULL values for many fields even though lookup is complete and has no issues. I am wondering what has changed that is causing this in below version and how to remediate it?

Splunk Enterprise Version: 9.3.1
Build: 0b8d769cb912

index=A sourcetype=B | stats count by XYZ | lookup ABC XYZ as XYZ OUTPUT FieldA, FieldB

Re: Lookup definition is outputting incomplete results

dural_yyz — Wed, 20 Nov 2024 14:40:41 GMT

Not sure this is really an issue, but I would from practice keep the event and lookup field names a little different. It could prevent any unintended complications in displaying or transforming data.

Re: Lookup definition is outputting incomplete results

mbasharat — Wed, 20 Nov 2024 15:25:47 GMT

@dural_yyz yes, field names are kept different.

Re: Lookup definition is outputting incomplete results

yuanliu — Thu, 21 Nov 2024 06:31:51 GMT

Did your lookup grow in size during this time? I had this problem with a large lookup a while ago. Check out Why does lookup return null when there are multiple matches.