Issue in csv lookup while summarization

[keerthana_k]

Hi,

We have scheduled saved search running every 5 minutes to create summary index.

In our test setup we get 200 log events every 5 minutes. The log events contain ServerIP field. We do a CSV lookup to get meaningful name for the server IP.

Our summarization query looks like this:

First part of the query | stats …… by _time, ServerIP, ….| lookup for ServerName | other fields.

When we verified the data in summarized index, there are some null values for the ServerName field. For the same ServerIP the lookup is successful at times and failing at other times.

Additional Information:

The CSV file has 50 entries
The IP addresses for which we do lookup are in positions 24 and 30.

[keerthana_k · Accepted solution]

The problem was that the CSV file was up to date in one indexer and not updated in the other one. Hence the lookup was failing half the time.