Splunk Search

Why does my automatic lookup not work before the first pipe in a search?

jeremiahc4
Builder

I've got a strange problem where I can't quite figure out why my automatic lookups work fine anywhere after a pipe, but do not work before the first pipe. What makes it even odder is I have 2 very similar lookups on the same data and 1 works fine for both pre/post pipe while the other does not. I have double & triple checked settings and can't see anything missing.

Example that doesn't work:

index=blah autolookupfield="xyz"

Examples that do work:

index=blah | search autolookupfield="xyz"
index=blah | stats count by autolookupfield

Does this ring any bells with anyone?

0 Karma

jkat54
SplunkTrust
SplunkTrust

It sounds like your lookup is malformed.

Try setting the lookup to be app only vs global. Then try the stats command in your app, see it break, then run the same stats command in another app and see if it also breaks. My hunch is the lookup contains some none word characters, extra pipes etc which are conflicting with the "search pipeline".

0 Karma

jeremiahc4
Builder

Guess I never did finish up with this, I just wound up using the workaround. There are 2 props.conf entries in play here. The lookup depends on a search time extraction which the props.conf docs say is legit. Oddly about 2 months ago the | stats ... stopped working also. It still works if I pipe it through a | search .... I've masked some things from the conf info below as it contained names I couldn't share, but functionally it is the same.

From props.conf;

[my_sourcetype]
LOOKUP-my_supplement = my_supplement myType AS myType OUTPUTNEW autolookupfield AS autolookupfield 
EXTRACT-messagetype = myMessage(?<myType>\d\d\d\d)

From transforms.conf

[my_supplement]
filename = my_supplement.csv
0 Karma

muebel
SplunkTrust
SplunkTrust

can you add your props and transforms config?

Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...