ES 3 lookup expander

[dbylertbg]

A customer is having trouble with their ES installation -- for some reason the lookup expander is not working properly. It seems that it may not be reading the input file? See the line below from python_modular_input.log:

2014-05-09 11:18:47,620 INFO pid=47089 tid=asset file=conversion.py:process:276 | PROCESSING: All 0 input lines completed.

The process appears to proceed fairly normally (as compared with a working installation) with the exception being that the working installation processes numerous input lines and and then enumerates the contents of those lines in the logs, resulting in working expanded CSVs. The non-working installation does not log any errors -- just says that there were 0 input lines and finishes without expanding the lookups. The lookup works normally in core splunk (i.e. inputlookup append=T asset_lookup).

[tkiss]

Hi,

The same thing happens here. Identities are working fine though, but assets are not expanding. Ive tried numerous times with different filenames, settings but no luck. No errors in logs, inputlookup works fine but assets are not expanded.

Runnin ess 3.1.1 on Splunk 6.1.3 on windows 2012 r2.

Anyone able to help or point to the right direction?

Thanks,
Tamas

[tkiss]

Anyone experiencing the same?