Splunk Search

How do you allow automatically match against lookup file multi-value field

splunker1981
Path Finder

Hello experts - 

I'm scratching my head trying to figure out if there's something at the low level configuration side that needs to be done to allow lookup matches against a multi valued field.  I have two environments, with relatively same data, where I'm able to run a lookup and get back data on one but not the other using a similar approach. See sample search below 

 

| makeresults 
| eval uid= "1017" 
| lookup cust_uid.csv po_id as uid OUTPUT region, customer

 

The contents of the lookup files is relatively the same on both but when I run the same command I get a match on one splunk instance but not the other. Below is a snippet of the lookup contents - 3 sample entries

 

customer,region,po_id
XXX,US - West,"0
19263
129888
locale-39488"
YYY,US - East,"1299
3453"
UUU,BRZ,1017

 

Again, I'm not quite sure why I can't do a simple lookup against the multi valued field po_id and get back the 2 fields I call out in the output, thoughts?

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try mvexpand on po_id so you can lookup against each value separately

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...