How to use time-base-lookup?

[akanno]

Hi,Splunk community.

I have a question about time-base-lookup.

I set following attribute to transforms.conf

[test]
collection = test
external_type = kvstore
fields_list = ip,unit,time
time_field = time
time_format = %d/%m/%y/%H

and I set following attribute to collections.conf.

[test]

Result of "| inputlookup test" is following.

ip time unit
192.168.150.81 09/12/14/18 B部
192.168.150.6 09/12/14/18 A部
192.168.150.81 09/12/14/17 D部
192.168.150.6 09/12/14/17 C部

I search by "index=test | lookup test ip".
However lookup does not work.

Why doesn't work?
Is there a way to solve?

[dolivasoh]

You had it right with "| inputlookup test", just continue your search from there or use the lookup table as enrichment to indexed data. Lookups do no go in the index.

[akanno]

dolivasoh,Thank you for your response.

I have tried outputting the field as "index=test | lookup test ip output unit | table _time,unit,ip".

However , I don't get "unit" field.

[dolivasoh]

Try outputting the field you want from the lookup table, lookup {{table_name}} {{input_field}} output {{output_field}}

[akanno]

Results when I search in "index=test | table _time,ip" are following.

results
_time ip
2014-12-09 18:00:01 192.168.150.81
2014-12-09 18:00:01 192.168.150.81
2014-12-09 18:00:01 192.168.150.6

If lookup correctly works , results when I search "index=test | lookup test ip | table _time,unit,ip" are like following.

results
_time unit ip
2014-12-09 18:00:01 B部 192.168.150.81
2014-12-09 18:00:01 B部 192.168.150.81
2014-12-09 18:00:01 A部 192.168.150.6

However , I don't get the above results.
why can't I get the above result?
Results I get are following

results
_time unit ip
2014-12-09 18:00:01 192.168.150.81
2014-12-09 18:00:01 192.168.150.81
2014-12-09 18:00:01 192.168.150.6