Splunk lookup failing, even on itself

[eandres]

Running a lookup where I have verified the fields exist and match and its not returning an output field. So, I verified by running the lookup by itself and it still doesn't match. I have checked permissions, ran the search from the app it belongs to. I can view the lookup with "| inputlookup <name>".

Example running the lookup on itself:

| inputlookup myfile
| table a, b
| lookup myfile a OUTPUT b AS c
| table a, b, c

c always shows as empty for this one lookup

[eandres · Accepted solution]

This is a time-based lookup, so if the _time in your event is not close enough to the time field in the lookup, it will not return a match.

[eandres]

I believe this has something to do with the lookup having time_field set in the transforms.conf. e.g. "time_field = d"

[livehybrid]

Hi @eandres 

In Splunk, when defining a lookup within transforms.conf, the time_field parameter is used to specify a field in the lookup table that represents a timestamp. This allows Splunk to apply time-based filtering, ensuring that lookup results are relevant to the event’s timestamp

How to Troubleshoot and Fix

• Verify the format of timestamps in your lookup file and ensure time_format matches.
• Check if your events fall within the expected time range of the lookup.
• Test the lookup manually using | inputlookup my_lookup to confirm that timestamps are stored correctly.
• Remove time_field if time-based filtering is not required.

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will