It seems that my KV Store lookup only works when the field selected to be looked up is lowercase or numeric. If I have a field with an uppercase component and try to lookup against a matching KV store field, it returns nothing? I have tested this and making everything in the results field I am looking up lowercase and having the matching KV store column changed to all lowercase works.
So Abc (results) does not match against Abc (KV store), but abc (results) matches against abc (KV store).
Maybe a bug - I saw another similar answer referencing SPL-102111, but do not see this logged in the Known Issue release notes for Splunk. Am using 6.2.4. Thanks!