Splunk Search

Automatic lookup field not displayed


I created the below automatic lookup through Splunk 6 web.

app_info host AS host gate AS gate OUTPUTNEW app AS app 

If I use this lookup in a search it works as expected. However, when simply searching the source the output field is not displayed.

Am I missing something?

Tags (3)
0 Karma


I've found that the automatic lookups don't work with apps that they are not created under. Either 1 you will need to move the config settings to system, or 2 create the same lookup again for each app(and upload multiple csv files)

Here is some info on setting it up to be in system instead of a specific app:


Agreed, I just created my entire lookup (table, definition, and automatic lookup) in the app I want it in and it isn't showing the automatic lookup. Did you ever find an answer for this?

0 Karma


Thanks. I've done this but it still doesn't seem that it is working. I guess I need to look into this more and do some more testing.

0 Karma
Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...