Automatic lookup on eventtype not working - same lookup works inline

snoobzilla — Mon, 28 Sep 2020 16:20:30 GMT

I am working on a way to bucket java stacktraces and assign numbers to those signatures... lookups seem an obvious choice. However, when I try autolookups on eventtype they don't work even though they work on inline searches. It would be much better for my users to have this lookup automatic.

Works inline:
eventtype=KER* | lookup FIXIT_SIGTEST BRACKET AS BRACKET CLASS AS CLASS EXCEPTION AS EXCEPTION FILENAME AS FILENAME FIRSTLINE AS FIRSTLINE METHOD AS METHOD eventtype AS eventtype linecount AS linecount weberr AS weberr OUTPUTNEW KER AS KER2

eventtype=KER* | lookup FIXIT_SIGTEST BRACKET CLASS EXCEPTION AS EXCEPTION FILENAME FIRSTLINE METHOD eventtype linecount weberr OUTPUTNEW KER AS KER3

Auto lookups not working (same sourcetype pasted from manager):
FIXIT_SIGTEST BRACKET CLASS EXCEPTION FILENAME FIRSTLINE KER_TYPE METHOD eventtype linecount weberr OUTPUTNEW KER AS KER3

FIXIT_SIGTEST BRACKET AS BRACKET CLASS AS CLASS EXCEPTION AS EXCEPTION FILENAME AS FILENAME FIRSTLINE AS FIRSTLINE METHOD AS METHOD eventtype AS eventtype linecount AS linecount weberr AS weberr OUTPUTNEW KER AS KER2

Re: Automatic lookup on eventtype not working - same lookup works inline

snoobzilla — Tue, 08 Jul 2014 22:29:33 GMT

Still no luck with eventtype... plan to move to a single value field instead.

Re: Automatic lookup on eventtype not working - same lookup works inline

snoobzilla — Wed, 09 Jul 2014 14:12:19 GMT

Issue indeed seems to be around multivalue field used as part of input of lookup. Got it working now leveraging an extracted non mv field.

topic Re: Automatic lookup on eventtype not working - same lookup works inline in Splunk Search

Automatic lookup on eventtype not working - same lookup works inline

Re: Automatic lookup on eventtype not working - same lookup works inline

Re: Automatic lookup on eventtype not working - same lookup works inline