Splunk Enterprise Security

How to get lookup results into datamodel

dolezelk
Explorer

I am trying to get lookup results into accelerated datamodel, but no luck so far.
I am using network_traffic datamodel, where I have added new auto extracted field.

I have tried to setup automatic lookup, which returns that field. I have confirmed that it is working correctly in search. Permissions are global, everybody has Read, admin Write.

when I use |tstats summary only, it will return that field as empty, when I do same command without summary only, it will return field value correctly

Secondly I have removed automatic lookup and added that lookup directly into datamodel as lookup field. I selected correct lookup, filled all fields and the preview shows everything is fine.
During DM acceleration I end up with error , "lookup could not be found or accessed ...."

Went through all the permissions but no problem there.
IT this some kind of bug in Splunk ?

camillak
Path Finder

I think I need more details - I use a lookup field in an accelerated data model with no issue. Is your lookup in transforms / is it defined under Settings > Lookups > Lookup definitions?

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...