topic Re: Latest 6.1.1 lookup attribute definition UI for data models broken? in Splunk Search

Latest 6.1.1 lookup attribute definition UI for data models broken?

lianjunj — Thu, 15 May 2014 19:44:18 GMT

With latest 6.1.1 installation, the UI for adding a lookup attribute to the data model seems not working any more. Not able to attach the screenshot to post (due to insufficient Karma), but this issue is 100% reproducible. Just create a new data model and add an attribute using the default dnslookup. Is this a known issue?

Re: Latest 6.1.1 lookup attribute definition UI for data models broken?

hexx — Fri, 16 May 2014 00:28:10 GMT

As far as I can tell, this is not a known issue with 6.1 / 6.1.1. I would like to suggest that you open a case with Splunk Support. Please indicate if you know for a fact that this was working in 6.0.x under the same conditions.

Re: Latest 6.1.1 lookup attribute definition UI for data models broken?

hexx — Fri, 16 May 2014 04:58:40 GMT

The workflow for this page has been changed in Splunk 6.1, where the user needs to pick a lookup to access the dialog where input and output fields can be defined.

However, this new workflow presents issues with two types of lookups:

Scripted lookups - These should just work, including the built-in "dnslookup" lookup. This was filed as a bug: SPL-84210.
Lookups that reference an empty table - There should be better messaging in this scenario, notifying the user that we have no fields to work with due to the empty table. This was filed as a bug: SPL-81851.

We hope to have this usability issues addressed soon in a 6.1.x maintenance release.

Re: Latest 6.1.1 lookup attribute definition UI for data models broken?

lianjunj — Fri, 16 May 2014 16:23:35 GMT

Yes, I have tried the same procedure on a 6.0.x instance, which works.