Example of issue encountering:
Search one returns a row with all the fields populated
| makeresults count=1
| eval tmp_field1="abc"
| lookup kvstore_name field1 AS tmp_field1
Search two returns a row with most of the fields empty (even though it is a search of the same row in the kvstore - just using a different field)
| makeresults count=1
| eval tmp_field2="xyz"
| lookup kvstore_name field2 AS tmp_field2
What could cause the results described above? (any recommendations would be greatly appreciated)
The following search will return values for all the fields
| inputlookup kvstore_name
| where field2="xyz"
Any guesses on the cause of this issue?