Splunk Search

Problems filtering results using lookup field

Path Finder

I have an automatic lookup that works ok but when I try to filter results by selecting a field that comes from the lookup table, it only works using a piped search command, like this

index=A lookupfield=value (does not work)
index=A | search lookupfield=value (works!)

I have other similar lookups (other index, other CSV file, but similar configurations) that work with both searches...the advantage of the "direct" filtering is the use of the drilldown on the fields of the side bar.

Anyway, I feel something is wrong if both lookups have different behaviours.
What can be wrong with this ?

Tags (3)

Path Finder

Well, I figured the problem and it was actually related to an field extraction that was used as the input field to the problematic lookup.

That field is extracted from a very long string in the raw data where only the first 800 chars are used, like this:


After extraction, this field is used for the lookup (and it works) but the actual field does not work for direct filtering results

index=A OriginalField=OriginalValue

That's because Splunk considers the "longer string" as the full value of the field and only returns results using

index=A OriginalField=OriginalValue*

SO, when using the field from the Automatic Lookup, using Job Inspection I saw that Splunk "under the covers" is actually doing this:

index=A LookupFiled=value ===> index=A OriginalField=OriginalValue AND LookupField=value

And that's why it produces no results 😞

The solution was to add a * to the end of lookup value in the Lookup Table and create a Calculated Field with the * to use as the lookup input 😉

Hope this can help somone 😉

0 Karma

Path Finder
0 Karma
Get Updates on the Splunk Community!

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Tips & Tricks When Using Ingest Actions

Tune in to learn about:Large scale architecture when using Ingest ActionsRegEx performance considerations ...