Splunk Search

How do you allow automatically match against lookup file multi-value field

splunker1981
Path Finder

Hello experts - 

I'm scratching my head trying to figure out if there's something at the low level configuration side that needs to be done to allow lookup matches against a multi valued field.  I have two environments, with relatively same data, where I'm able to run a lookup and get back data on one but not the other using a similar approach. See sample search below 

 

| makeresults 
| eval uid= "1017" 
| lookup cust_uid.csv po_id as uid OUTPUT region, customer

 

The contents of the lookup files is relatively the same on both but when I run the same command I get a match on one splunk instance but not the other. Below is a snippet of the lookup contents - 3 sample entries

 

customer,region,po_id
XXX,US - West,"0
19263
129888
locale-39488"
YYY,US - East,"1299
3453"
UUU,BRZ,1017

 

Again, I'm not quite sure why I can't do a simple lookup against the multi valued field po_id and get back the 2 fields I call out in the output, thoughts?

Labels (1)
0 Karma

ITWhisperer
Legend

Try mvexpand on po_id so you can lookup against each value separately

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!