CSV lookups failing

[strive]

Hi,

We have a CSV file containing names and ids. Same name can be present for multiple ids.

Name  Id
A     1
B     2
B     20
B     200
C     3
D     78
E     4
E     34
E     57
F     100

In logs we get Id. We lookup CSV file and get Name and summarize this data. right now our logs contain only id 2 and 4.
Assume that there are 100 events in a time span which we are summarizing. The lookup fails for some events even though it is the same id for which the lookup was successful. Sometimes it works and sometimes it fails. We see null values for Name field in our summary index.

Under what circumstances the lookup fails? The search is scheduled and it runs at scheduled time.

Thanks

Strive

[lguinn2]

Is the field extraction correct in all the events? If the field extraction is working properly for only some of the events, the lookup would work only for those events.

yoursearchhere
| lookupcmdhere

Run this in verbose mode. Choose "select and show in results" for the Name and Id fields, so that the fields show up beneath the events. This may show you what is going wrong...