Splunk Search

Latest 6.1.1 lookup attribute definition UI for data models broken?

lianjunj
Explorer

With latest 6.1.1 installation, the UI for adding a lookup attribute to the data model seems not working any more. Not able to attach the screenshot to post (due to insufficient Karma), but this issue is 100% reproducible. Just create a new data model and add an attribute using the default dnslookup. Is this a known issue?

1 Solution

hexx
Splunk Employee
Splunk Employee

The workflow for this page has been changed in Splunk 6.1, where the user needs to pick a lookup to access the dialog where input and output fields can be defined.

However, this new workflow presents issues with two types of lookups:

  • Scripted lookups - These should just work, including the built-in "dnslookup" lookup. This was filed as a bug: SPL-84210.
  • Lookups that reference an empty table - There should be better messaging in this scenario, notifying the user that we have no fields to work with due to the empty table. This was filed as a bug: SPL-81851.

We hope to have this usability issues addressed soon in a 6.1.x maintenance release.

View solution in original post

lianjunj
Explorer

Yes, I have tried the same procedure on a 6.0.x instance, which works.

0 Karma

hexx
Splunk Employee
Splunk Employee

The workflow for this page has been changed in Splunk 6.1, where the user needs to pick a lookup to access the dialog where input and output fields can be defined.

However, this new workflow presents issues with two types of lookups:

  • Scripted lookups - These should just work, including the built-in "dnslookup" lookup. This was filed as a bug: SPL-84210.
  • Lookups that reference an empty table - There should be better messaging in this scenario, notifying the user that we have no fields to work with due to the empty table. This was filed as a bug: SPL-81851.

We hope to have this usability issues addressed soon in a 6.1.x maintenance release.

View solution in original post

hexx
Splunk Employee
Splunk Employee

As far as I can tell, this is not a known issue with 6.1 / 6.1.1. I would like to suggest that you open a case with Splunk Support. Please indicate if you know for a fact that this was working in 6.0.x under the same conditions.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!