Hello experts -
I'm scratching my head trying to figure out if there's something at the low level configuration side that needs to be done to allow lookup matches against a multi valued field. I have two environments, with relatively same data, where I'm able to run a lookup and get back data on one but not the other using a similar approach. See sample search below
| makeresults
| eval uid= "1017"
| lookup cust_uid.csv po_id as uid OUTPUT region, customer
The contents of the lookup files is relatively the same on both but when I run the same command I get a match on one splunk instance but not the other. Below is a snippet of the lookup contents - 3 sample entries
customer,region,po_id
XXX,US - West,"0
19263
129888
locale-39488"
YYY,US - East,"1299
3453"
UUU,BRZ,1017
Again, I'm not quite sure why I can't do a simple lookup against the multi valued field po_id and get back the 2 fields I call out in the output, thoughts?
