Splunk Search

Problems filtering results using lookup field

Path Finder

I have an automatic lookup that works ok but when I try to filter results by selecting a field that comes from the lookup table, it only works using a piped search command, like this

index=A lookupfield=value (does not work)
index=A | search lookupfield=value (works!)

I have other similar lookups (other index, other CSV file, but similar configurations) that work with both searches...the advantage of the "direct" filtering is the use of the drilldown on the fields of the side bar.

Anyway, I feel something is wrong if both lookups have different behaviours.
What can be wrong with this ?

Tags (3)

Path Finder

Well, I figured the problem and it was actually related to an field extraction that was used as the input field to the problematic lookup.

That field is extracted from a very long string in the raw data where only the first 800 chars are used, like this:


After extraction, this field is used for the lookup (and it works) but the actual field does not work for direct filtering results

index=A OriginalField=OriginalValue

That's because Splunk considers the "longer string" as the full value of the field and only returns results using

index=A OriginalField=OriginalValue*

SO, when using the field from the Automatic Lookup, using Job Inspection I saw that Splunk "under the covers" is actually doing this:

index=A LookupFiled=value ===> index=A OriginalField=OriginalValue AND LookupField=value

And that's why it produces no results 😞

The solution was to add a * to the end of lookup value in the Lookup Table and create a Calculated Field with the * to use as the lookup input 😉

Hope this can help somone 😉

0 Karma

Path Finder
0 Karma
Get Updates on the Splunk Community!

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...