Splunk Search

Why does my autolookup definition produce unexpected results with different search strings?

Cuyose
Builder

I am having an odd issue. I created an autolookup definition that seems to be working under certain circumstances. Other times it either doesn't work as I expect or works horribly inefficiently.

Lookup contains a mapping column from an auto extracted field with other columns for Country, City, CallCenter.

The search below works just fine.
index=app
host=host*
source="sourcefile*"
sourcetype=sourctypeX
|top Country

will return a row with Philippines 97634

This is where things get odd. If you click the Philippines link in the results to view events it generates the following search which returns nothing.
index=app
host="host*"
source="sourcefile*"
sourcetype=sourctypeX
Country=Philippines

It gets weirder as well adding a wildcard after the Country finds a small subset of the first search, in this case a single event
index=app
host=host*
source="sourcefile*"
sourcetype=sourctypeX
Country=Philippines*

What is going on here? Why can't I do a search for:

index=app
host=host*
source="sourcefile*"
sourcetype=sourctypeX
Country=Phillipines
|timechart count by CallCenter

0 Karma

stephanefotso
Motivator

Hello! Did your verify the time range? Set it to all time and let me know
Thanks

SGF
0 Karma

Cuyose
Builder

All example searches were done for a 5 minute range.

0 Karma

stephanefotso
Motivator

I want to say, when you click the Philippines link in the results to view events, change the time range of the search in the search bar to all time and let me know.
If still not working, make sure that, your lookup table and lookup definition are shared globally.

SGF
0 Karma
Get Updates on the Splunk Community!

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...

Stay Connected: Your Guide to February Tech Talks, Office Hours, and Webinars!

💌Keep the new year’s momentum going with our February lineup of Community Office Hours, Tech Talks, ...