topic Re: Automatic lookup field not displayed in Splunk Search

Automatic lookup field not displayed

sc0tt — Mon, 23 Dec 2013 14:06:13 GMT

I created the below automatic lookup through Splunk 6 web.

app_info host AS host gate AS gate OUTPUTNEW app AS app

If I use this lookup in a search it works as expected. However, when simply searching the source the output field is not displayed.

Am I missing something?

Re: Automatic lookup field not displayed

aelliott — Mon, 23 Dec 2013 16:01:06 GMT

I've found that the automatic lookups don't work with apps that they are not created under. Either 1 you will need to move the config settings to system, or 2 create the same lookup again for each app(and upload multiple csv files)

Here is some info on setting it up to be in system instead of a specific app:
http://docs.splunk.com/Documentation/Splunk/6.0/Knowledge/Addfieldsfromexternaldatasources

Re: Automatic lookup field not displayed

sc0tt — Thu, 26 Dec 2013 15:00:25 GMT

Thanks. I've done this but it still doesn't seem that it is working. I guess I need to look into this more and do some more testing.

Re: Automatic lookup field not displayed

jeremiahc4 — Fri, 01 Aug 2014 15:07:08 GMT

Agreed, I just created my entire lookup (table, definition, and automatic lookup) in the app I want it in and it isn't showing the automatic lookup. Did you ever find an answer for this?