Splunk Search

Problems filtering results using lookup field

ruiaires
Path Finder

I have an automatic lookup that works ok but when I try to filter results by selecting a field that comes from the lookup table, it only works using a piped search command, like this

index=A lookupfield=value (does not work)
index=A | search lookupfield=value (works!)

I have other similar lookups (other index, other CSV file, but similar configurations) that work with both searches...the advantage of the "direct" filtering is the use of the drilldown on the fields of the side bar.

Anyway, I feel something is wrong if both lookups have different behaviours.
What can be wrong with this ?

Tags (3)

ruiaires
Path Finder

Well, I figured the problem and it was actually related to an field extraction that was used as the input field to the problematic lookup.

That field is extracted from a very long string in the raw data where only the first 800 chars are used, like this:

OriginalField:\s(?P.{800})

After extraction, this field is used for the lookup (and it works) but the actual field does not work for direct filtering results

index=A OriginalField=OriginalValue

That's because Splunk considers the "longer string" as the full value of the field and only returns results using

index=A OriginalField=OriginalValue*

SO, when using the field from the Automatic Lookup, using Job Inspection I saw that Splunk "under the covers" is actually doing this:

index=A LookupFiled=value ===> index=A OriginalField=OriginalValue AND LookupField=value

And that's why it produces no results 😞

The solution was to add a * to the end of lookup value in the Lookup Table and create a Calculated Field with the * to use as the lookup input 😉

Hope this can help somone 😉

0 Karma

ruiaires
Path Finder
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...