Splunk Search

Problems filtering results using lookup field

ruiaires
Path Finder

I have an automatic lookup that works ok but when I try to filter results by selecting a field that comes from the lookup table, it only works using a piped search command, like this

index=A lookupfield=value (does not work)
index=A | search lookupfield=value (works!)

I have other similar lookups (other index, other CSV file, but similar configurations) that work with both searches...the advantage of the "direct" filtering is the use of the drilldown on the fields of the side bar.

Anyway, I feel something is wrong if both lookups have different behaviours.
What can be wrong with this ?

Tags (3)

ruiaires
Path Finder

Well, I figured the problem and it was actually related to an field extraction that was used as the input field to the problematic lookup.

That field is extracted from a very long string in the raw data where only the first 800 chars are used, like this:

OriginalField:\s(?P.{800})

After extraction, this field is used for the lookup (and it works) but the actual field does not work for direct filtering results

index=A OriginalField=OriginalValue

That's because Splunk considers the "longer string" as the full value of the field and only returns results using

index=A OriginalField=OriginalValue*

SO, when using the field from the Automatic Lookup, using Job Inspection I saw that Splunk "under the covers" is actually doing this:

index=A LookupFiled=value ===> index=A OriginalField=OriginalValue AND LookupField=value

And that's why it produces no results 😞

The solution was to add a * to the end of lookup value in the Lookup Table and create a Calculated Field with the * to use as the lookup input 😉

Hope this can help somone 😉

0 Karma

ruiaires
Path Finder
0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...