Splunk Search

Do KV store lookups only currently work with numeric and lowercase fields?

pj
Contributor

It seems that my KV Store lookup only works when the field selected to be looked up is lowercase or numeric. If I have a field with an uppercase component and try to lookup against a matching KV store field, it returns nothing? I have tested this and making everything in the results field I am looking up lowercase and having the matching KV store column changed to all lowercase works.

So Abc (results) does not match against Abc (KV store), but abc (results) matches against abc (KV store).

Maybe a bug - I saw another similar answer referencing SPL-102111, but do not see this logged in the Known Issue release notes for Splunk. Am using 6.2.4. Thanks!

0 Karma
1 Solution

ltrand
Contributor

There was an issue that 6.2.6 resolves:

"2015-9-9 SPL-102111 kvstore lookup fails with case insensitive matching."
http://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/6.2.6

Maybe this is related to your issue? What version are you currently running?

View solution in original post

ltrand
Contributor

There was an issue that 6.2.6 resolves:

"2015-9-9 SPL-102111 kvstore lookup fails with case insensitive matching."
http://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/6.2.6

Maybe this is related to your issue? What version are you currently running?

pj
Contributor

Yes, it is exactly related. Thanks for letting me know.

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...