Splunk Enterprise Security

How to get lookup results into datamodel

dolezelk
Explorer

I am trying to get lookup results into accelerated datamodel, but no luck so far.
I am using network_traffic datamodel, where I have added new auto extracted field.

I have tried to setup automatic lookup, which returns that field. I have confirmed that it is working correctly in search. Permissions are global, everybody has Read, admin Write.

when I use |tstats summary only, it will return that field as empty, when I do same command without summary only, it will return field value correctly

Secondly I have removed automatic lookup and added that lookup directly into datamodel as lookup field. I selected correct lookup, filled all fields and the preview shows everything is fine.
During DM acceleration I end up with error , "lookup could not be found or accessed ...."

Went through all the permissions but no problem there.
IT this some kind of bug in Splunk ?

camillak
Path Finder

I think I need more details - I use a lookup field in an accelerated data model with no issue. Is your lookup in transforms / is it defined under Settings > Lookups > Lookup definitions?

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...