Latest 6.1.1 lookup attribute definition UI for data models broken?

[lianjunj]

With latest 6.1.1 installation, the UI for adding a lookup attribute to the data model seems not working any more. Not able to attach the screenshot to post (due to insufficient Karma), but this issue is 100% reproducible. Just create a new data model and add an attribute using the default dnslookup. Is this a known issue?

[lianjunj]

Yes, I have tried the same procedure on a 6.0.x instance, which works.

[hexx · Accepted solution]

The workflow for this page has been changed in Splunk 6.1, where the user needs to pick a lookup to access the dialog where input and output fields can be defined.

However, this new workflow presents issues with two types of lookups:

• Scripted lookups - These should just work, including the built-in "dnslookup" lookup. This was filed as a bug: SPL-84210.
• Lookups that reference an empty table - There should be better messaging in this scenario, notifying the user that we have no fields to work with due to the empty table. This was filed as a bug: SPL-81851.

We hope to have this usability issues addressed soon in a 6.1.x maintenance release.

[hexx]

As far as I can tell, this is not a known issue with 6.1 / 6.1.1. I would like to suggest that you open a case with Splunk Support. Please indicate if you know for a fact that this was working in 6.0.x under the same conditions.