Automatic lookup on eventtype not working - same lookup works inline

[snoobzilla]

I am working on a way to bucket java stacktraces and assign numbers to those signatures... lookups seem an obvious choice. However, when I try autolookups on eventtype they don't work even though they work on inline searches. It would be much better for my users to have this lookup automatic.

Works inline:
eventtype=KER* | lookup FIXIT_SIGTEST BRACKET AS BRACKET CLASS AS CLASS EXCEPTION AS EXCEPTION FILENAME AS FILENAME FIRSTLINE AS FIRSTLINE METHOD AS METHOD eventtype AS eventtype linecount AS linecount weberr AS weberr OUTPUTNEW KER AS KER2

eventtype=KER* | lookup FIXIT_SIGTEST BRACKET CLASS EXCEPTION AS EXCEPTION FILENAME FIRSTLINE METHOD eventtype linecount weberr OUTPUTNEW KER AS KER3

Auto lookups not working (same sourcetype pasted from manager):
FIXIT_SIGTEST BRACKET CLASS EXCEPTION FILENAME FIRSTLINE KER_TYPE METHOD eventtype linecount weberr OUTPUTNEW KER AS KER3

FIXIT_SIGTEST BRACKET AS BRACKET CLASS AS CLASS EXCEPTION AS EXCEPTION FILENAME AS FILENAME FIRSTLINE AS FIRSTLINE METHOD AS METHOD eventtype AS eventtype linecount AS linecount weberr AS weberr OUTPUTNEW KER AS KER2

[snoobzilla · Accepted solution]

Issue indeed seems to be around multivalue field used as part of input of lookup. Got it working now leveraging an extracted non mv field.

[snoobzilla]

Still no luck with eventtype... plan to move to a single value field instead.