Problems filtering results using lookup field

[ruiaires]

I have an automatic lookup that works ok but when I try to filter results by selecting a field that comes from the lookup table, it only works using a piped search command, like this

index=A lookupfield=value (does not work)
index=A | search lookupfield=value (works!)

I have other similar lookups (other index, other CSV file, but similar configurations) that work with both searches...the advantage of the "direct" filtering is the use of the drilldown on the fields of the side bar.

Anyway, I feel something is wrong if both lookups have different behaviours.
What can be wrong with this ?

[ruiaires]

Well, I figured the problem and it was actually related to an field extraction that was used as the input field to the problematic lookup.

That field is extracted from a very long string in the raw data where only the first 800 chars are used, like this:

OriginalField:\s(?P.{800})

After extraction, this field is used for the lookup (and it works) but the actual field does not work for direct filtering results

index=A OriginalField=OriginalValue

That's because Splunk considers the "longer string" as the full value of the field and only returns results using

index=A OriginalField=OriginalValue*

SO, when using the field from the Automatic Lookup, using Job Inspection I saw that Splunk "under the covers" is actually doing this:

index=A LookupFiled=value ===> index=A OriginalField=OriginalValue AND LookupField=value

And that's why it produces no results 😞

The solution was to add a * to the end of lookup value in the Lookup Table and create a Calculated Field with the * to use as the lookup input 😉

Hope this can help somone 😉

[ruiaires]

Actually this issue was also clarified in this question: http://answers.splunk.com/answers/26571/unable-to-search-for-extracted-substring-if-didnt-startend-w...