Splunk Search

Why does my automatic lookup not work before the first pipe in a search?

Builder

I've got a strange problem where I can't quite figure out why my automatic lookups work fine anywhere after a pipe, but do not work before the first pipe. What makes it even odder is I have 2 very similar lookups on the same data and 1 works fine for both pre/post pipe while the other does not. I have double & triple checked settings and can't see anything missing.

Example that doesn't work:

index=blah autolookupfield="xyz"

Examples that do work:

index=blah | search autolookupfield="xyz"
index=blah | stats count by autolookupfield

Does this ring any bells with anyone?

0 Karma

SplunkTrust
SplunkTrust

It sounds like your lookup is malformed.

Try setting the lookup to be app only vs global. Then try the stats command in your app, see it break, then run the same stats command in another app and see if it also breaks. My hunch is the lookup contains some none word characters, extra pipes etc which are conflicting with the "search pipeline".

0 Karma

Builder

Guess I never did finish up with this, I just wound up using the workaround. There are 2 props.conf entries in play here. The lookup depends on a search time extraction which the props.conf docs say is legit. Oddly about 2 months ago the | stats ... stopped working also. It still works if I pipe it through a | search .... I've masked some things from the conf info below as it contained names I couldn't share, but functionally it is the same.

From props.conf;

[my_sourcetype]
LOOKUP-my_supplement = my_supplement myType AS myType OUTPUTNEW autolookupfield AS autolookupfield 
EXTRACT-messagetype = myMessage(?<myType>\d\d\d\d)

From transforms.conf

[my_supplement]
filename = my_supplement.csv
0 Karma

SplunkTrust
SplunkTrust

can you add your props and transforms config?

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!