Splunk DB Connect: Why am I unable to perform a lookup to enhance my dbquery results?

[dstaulcu]

I'd like to be able to enhance DB Connect results with details in a lookup table file.

For some reason, the lookup is not working. I know the host field exists both in my dbquery results and my lookup table file. Here is the syntax I am using:

| dbquery "myconnection" "mysqlquery" 
| fields host interestingvalue 
| lookup hostdetails.csv host OUTPUT interestinghostdetail

Anyone have any ideas why this isn't working / wouldn't work?

Inputs appreciated!

[ckurtz]

Make sure that the lookup of hostdetails.csv is available inside the DBXv1 app context.

[woodcock]

Try without fields.

[javiergn]

I would do it differently and using subsearches and inputlookup:

| inputlookup hostdetails
| search [| dbquery "myconnection" "mysqlquery" | table host interestingvalue]

[javiergn]

Keep in mind you could have the dbquery first and then filter based on your inputlookup