Do KV store lookups only currently work with numeric and lowercase fields?

[pj]

It seems that my KV Store lookup only works when the field selected to be looked up is lowercase or numeric. If I have a field with an uppercase component and try to lookup against a matching KV store field, it returns nothing? I have tested this and making everything in the results field I am looking up lowercase and having the matching KV store column changed to all lowercase works.

So Abc (results) does not match against Abc (KV store), but abc (results) matches against abc (KV store).

Maybe a bug - I saw another similar answer referencing SPL-102111, but do not see this logged in the Known Issue release notes for Splunk. Am using 6.2.4. Thanks!

[ltrand · Accepted solution]

There was an issue that 6.2.6 resolves:

"2015-9-9 SPL-102111 kvstore lookup fails with case insensitive matching."
http://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/6.2.6

Maybe this is related to your issue? What version are you currently running?

[pj]

Yes, it is exactly related. Thanks for letting me know.