Splunk Search

How do you allow automatically match against lookup file multi-value field

splunker1981
Path Finder

Hello experts - 

I'm scratching my head trying to figure out if there's something at the low level configuration side that needs to be done to allow lookup matches against a multi valued field.  I have two environments, with relatively same data, where I'm able to run a lookup and get back data on one but not the other using a similar approach. See sample search below 

 

| makeresults 
| eval uid= "1017" 
| lookup cust_uid.csv po_id as uid OUTPUT region, customer

 

The contents of the lookup files is relatively the same on both but when I run the same command I get a match on one splunk instance but not the other. Below is a snippet of the lookup contents - 3 sample entries

 

customer,region,po_id
XXX,US - West,"0
19263
129888
locale-39488"
YYY,US - East,"1299
3453"
UUU,BRZ,1017

 

Again, I'm not quite sure why I can't do a simple lookup against the multi valued field po_id and get back the 2 fields I call out in the output, thoughts?

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try mvexpand on po_id so you can lookup against each value separately

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...