We have a setup where Universal Forwarders send data to indexers and dedicated search heads search those indexers.
There is a lookup in $SPLUNKHOME/etc/system/lookups which is used in $SPLUNKHOME/etc/search/local/props.conf $SPLUNK_HOME/etc/search/local/transforms.conf that adds some fields to all events in Splunk (I moved props.conf and transforms.conf from system/local to the search app because I got errors when searching internal indexes on the search heads)
LOOKUP-table = my_lookup IP_NAME AS host
filename = mylist.csv
max_matches = 1
When I search, the fields correctly show up in the list of events in the flashtimeline view. But if I try to use one of the custom fields in my search not all of the events show up: