Lookup works on one instance, but not another

[jwalzerpitt]

I'm seeing a weird issue - I have two Splunk instances, one for prod and one for dev. I have a lookup created that looks for an IP and then compares it to the lookup list to see what CIDR it falls into and then extracts the firewall zone it's in. Here's a search I run in prod that works (returns the firewall zone):

index=foo sourcetype="foo"
| lookup ip_cidr.csv cidr_range as IP_Address
| eval firewall=coalesce(firewall,"null")
| eval context=coalesce(context,"null")
| eval zone=coalesce(zone,"null")
| stats count by IP_Address,zone
| fieldformat count=tostring(count,"commas") 
| sort -count

I get a list of IPs with the zone and the count

On dev, I'm running a similar search against our DNS logs:

index=bind `dns_whitelist`
| lookup ip_cidr.csv cidr_range as src
| eval firewall=coalesce(firewall,"null")
| eval context=coalesce(context,"null")
| eval zone=coalesce(zone,"null")
| stats count by src,zone,query
| fieldformat count=tostring(count,"commas") 
| sort -count

However, for this search the zone is returned as "null" for every IP. I verified the permissions for both the lookup file and the lookup definition and they're both set to Global and All apps.

I'm just at a loss as to what the difference is between the two. Any help would be appreciated.

Thx

[Yunagi · Accepted solution]

Have you checked the "Match type" setting for your lookup definitions? You need to click on "Advanced options" when editing a lookup definition to make it visible.
I believe the match type for your first lookup definition (prod) should be: CIDR(IP_Address)
For the second lookup definition (dev), it should be: CIDR(src)

[jwalzerpitt]

Thx Yunagi - that was it!

[Yunagi]

You're welcome. 🙂

[mdsnmss]

Run |input lookup ip_cidr.csv. Are the lookup tables the same on each instance? Does the lookup field "cidr_range" exist in your dev search? You can run just index=bind 'dns_whitelist' to check that. It seems like the lookup isn't finding anything and is reverting to a default value of null based on the lookup definition. The issues seems to point to a difference in fields between the two logs.

[jwalzerpitt]

I ran | inputlookup ip_cidr.csv on both instances and I'm seeing the same results - 2,439 results - on both instances.

Thx