Why does my automatic lookup not work before the first pipe in a search?

[jeremiahc4]

I've got a strange problem where I can't quite figure out why my automatic lookups work fine anywhere after a pipe, but do not work before the first pipe. What makes it even odder is I have 2 very similar lookups on the same data and 1 works fine for both pre/post pipe while the other does not. I have double & triple checked settings and can't see anything missing.

Example that doesn't work:

index=blah autolookupfield="xyz"

Examples that do work:

index=blah | search autolookupfield="xyz"
index=blah | stats count by autolookupfield

Does this ring any bells with anyone?

[jkat54]

It sounds like your lookup is malformed.

Try setting the lookup to be app only vs global. Then try the stats command in your app, see it break, then run the same stats command in another app and see if it also breaks. My hunch is the lookup contains some none word characters, extra pipes etc which are conflicting with the "search pipeline".

[jeremiahc4]

Guess I never did finish up with this, I just wound up using the workaround. There are 2 props.conf entries in play here. The lookup depends on a search time extraction which the props.conf docs say is legit. Oddly about 2 months ago the | stats ... stopped working also. It still works if I pipe it through a | search .... I've masked some things from the conf info below as it contained names I couldn't share, but functionally it is the same.

From props.conf;

[my_sourcetype]
LOOKUP-my_supplement = my_supplement myType AS myType OUTPUTNEW autolookupfield AS autolookupfield 
EXTRACT-messagetype = myMessage(?<myType>\d\d\d\d)

From transforms.conf

[my_supplement]
filename = my_supplement.csv

[muebel]

can you add your props and transforms config?