Issue with Sequence of Operation

[bharathkumarnec]

Hello Everyone,

Today i observed a weird behavior while using eval and kvstore lookup file, below is my case:

My query is :

| eval fieldname2=if(fieldname1="abc","Starting",fieldname2) | lookup local=true mylookup Key as fieldname2 OUTPUT fieldname3

When i run this search i am getting quite less number of matches and when i run below i get more matches

 | eval fieldname2=if(fieldname1="abc","Starting",fieldname2) | lookup local=true mylookup.csv Key as fieldname2 OUTPUT fieldname3

mylookup & mylookup.csv both have same set of data and the only difference is first one is a kv store and the next one is a lookup file.

Till we upgrade to 7.3.5 from 7.1.6 it was working without any issues, but post upgrade observed this weird behavior.

May be someone can help me to find out what i am missing here??

Thanks in advance!!

Regards,

BK

[anilchaithu]

@bharathkumarnec 

It might be due to case variance in the field names. kvstore lookups are case sensitive to field names while csv lookups are not.

Can you please verify that?

[bharathkumarnec]

Thanks for your input @anilchaithu , but when we use below it is working without any issues:

| eval fieldname2=if(fieldname1="abc","Starting",fieldname2)

| eventstats values(fieldname2) as fieldname2 by host

| lookup local=true mylookup Key as fieldname2 OUTPUT fieldname3

So placing | eventstats between working fine...and we are using the same cases as it is in the kv store..