Splunk Search
Highlighted

Do KV store lookups only currently work with numeric and lowercase fields?

Contributor

It seems that my KV Store lookup only works when the field selected to be looked up is lowercase or numeric. If I have a field with an uppercase component and try to lookup against a matching KV store field, it returns nothing? I have tested this and making everything in the results field I am looking up lowercase and having the matching KV store column changed to all lowercase works.

So Abc (results) does not match against Abc (KV store), but abc (results) matches against abc (KV store).

Maybe a bug - I saw another similar answer referencing SPL-102111, but do not see this logged in the Known Issue release notes for Splunk. Am using 6.2.4. Thanks!

0 Karma
Highlighted

Re: Do KV store lookups only currently work with numeric and lowercase fields?

Contributor

There was an issue that 6.2.6 resolves:

"2015-9-9 SPL-102111 kvstore lookup fails with case insensitive matching."
http://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/6.2.6

Maybe this is related to your issue? What version are you currently running?

View solution in original post

Highlighted

Re: Do KV store lookups only currently work with numeric and lowercase fields?

Contributor

Yes, it is exactly related. Thanks for letting me know.

0 Karma