Splunk Search

Why is my auto lookup not working as intended?

Path Finder

I have some searches that do not appear to be enhancing properly using the asset_lookup_by_str lookup table.

In this case, I'll use dvc, but it appears to be similar with the others like dest as well.

I run a search, the enhancements don't seem to be happening.

If I run a search using the lookup it works sometimes. I'll give a few examples

Search 1:


| lookup asset_lookup_by_str asset AS dvc OUTPUTNEW domain AS AAAAA 

Result 1: I get AAAAA to have only 1 of our 5 domains

Search 2: 

index=windows host=[hostname]

| lookup asset_lookup_by_str asset AS dvc OUTPUTNEW domain AS AAAAA 

Result 2: AAAAA doesn't show up .

Search 3: 
| inputlookup asset_lookup_by_str

Result 3: The lookup table appears to be filled in nicely. Including the domains missing from search 1.

Search 4: 
| inputlookup asset_lookup_by_str
| search asset=[host]

Result 4: The host searched in Search 2 is in the lookup table. 

Based on this, I'd say not only should Search 2 have worked, but Search 1 should have had more results, and the automatic lookup as a whole should be working.

Any ideas what could be happening? My only thought is maybe some sort of priority order that is overriding the enhancement feature. But that wouldn't explain it not working in the specific search. 


Labels (1)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...