Lookup definition is outputting incomplete results

[mbasharat]

Hi,

I have a simple search which is using a lookup definition based off of a lookup. This lookup is large. Search has been using this lookup perfectly fine outputting correct results. Since upgrade to below version of Splunk Enterprise, this output is not happening like it used to. Matched output is significantly reduced resulting in NULL values for many fields even though lookup is complete and has no issues. I am wondering what has changed that is causing this in below version and how to remediate it?

Splunk Enterprise Version: 9.3.1
Build: 0b8d769cb912

index=A sourcetype=B
| stats count by XYZ
| lookup ABC XYZ as XYZ OUTPUT FieldA, FieldB

[yuanliu]

Did your lookup grow in size during this time?  I had this problem with a large lookup a while ago.  Check out Why does lookup return null when there are multiple matches.

[dural_yyz]

Not sure this is really an issue, but I would from practice keep the event and lookup field names a little different.  It could prevent any unintended complications in displaying or transforming data.

[mbasharat]

@dural_yyz yes, field names are kept different.