Issue in excluding some results via Lookup table

[Erfan110]

Hi everyone
I created a look up table:

Department,Vendor,Type,url_domain,user,src_ip,Whitelisted
BigData,Material,Google Remote Desktop,Alpha.com,Alice,172.16.28.12,TRUE

Then I created a look up definition with this match type:

WILDCARD(url_domain), WILDCARD(user), WILDCARD(src_ip)

Then I tested it on following search but it didn't work.

index=fortigate src_ip=172.16.28.12 url_domain=Alpha.com
| lookup Whitelist url_domain user src_ip
| where isnull(Whitelisted)
| table _time, severity, user, url_domain, src_ip, dest_ip, dest_domain, transport, dest_port, vendor_action, app, vendor_eventtype, subtype, devname

and shows all results including traffic from 172.16.28.12 by Alice to the mentioned url 
Anyone has any idea what is the issue?

[PickleRick]

Department,Vendor,Type,url_domain,user,src_ip,Whitelisted
BigData,Material,Google Remote Desktop,Alpha.com,Alice,172.16.28.12,TRUE

Are you sure you copy-pasted whole lines?

First line has 8 fields, second one has 7.

[ITWhisperer]

@PickleRick Both have 7

[PickleRick]

OK. I'm either overworked or blind. I counted them several times and always came up with the same 8/7 numbers.

You're right. They both have 7 fields.

[ITWhisperer]

Setting up the lookup the way you described and using makeresults to generate events (rather than an index search) works for me as expected.

So, perhaps your real data or lookup is inconsistent with the description you gave, or you have found a bug. Which version of Splunk are you using?

[Erfan110]

Hi
You mean it excluded that traffic? Because I expect it to exclude the traffic from my results.

version 9.0

[ITWhisperer]

Yes, it worked

[Erfan110]

Hi
thanks for your response.
I tried same and it is working. but it does not work on my real data. 
The problem is IP Address. When I removed src_ip from lookup command it works on real records. But I cannot understand what is the problem!
I checked the name of the field in events and tried srcip and src_ip, both did not work. 

Regards