Splunk Search
Highlighted

Why isn't my lookup command working?

Explorer

Hi,

I have a problem when searching my lookup field. I added a lookup file to my search with 3 fields (Vulnerability, Risk, Reference). But when I'm searching with stats command or something else it shows me a different result.

Are there any solutions?

0 Karma
Highlighted

Re: Why isn't my lookup command working?

SplunkTrust
SplunkTrust

Hi @ khanlarloo,

Can you please provide your splunk query if possible?

0 Karma
Highlighted

Re: Why isn't my lookup command working?

Legend

Hi khanlarloo,
could you share your search?
Anyway check the file names and put a special attention to the cases of your values that could not match and if there are duplicate values!
Bye.
Giuseppe

0 Karma
Highlighted

Re: Why isn't my lookup command working?

Explorer

sourcetype=csv | stats count by Vulnerability

0 Karma
Highlighted

Re: Why isn't my lookup command working?

Explorer

i add a csv file named net.csv my lookup csv file is ios.csv
no there are no duplivate value

0 Karma
Highlighted

Re: Why isn't my lookup command working?

Communicator

Do have bit more detail about how you are calling the lookup and what your report looks like? i.e is this an automatic lookup or are you calling in within the report

0 Karma
Highlighted

Re: Why isn't my lookup command working?

Explorer

it is automatic lookup.

0 Karma
Highlighted

Re: Why isn't my lookup command working?

SplunkTrust
SplunkTrust

which fields have you mapped with automatic lookup ? When you try to search sourcetype=csv without stats command, are you able to see Vulnerability ,Risk,Refrence fields on left hand side as Interesting Fields?

0 Karma
Highlighted

Re: Why isn't my lookup command working?

Explorer

yes.i can see them in right pannel.but when i search them it shows different result.not showing the exact number
sourcetype=csv | stats count by Vulnerability Risk Refrence

0 Karma
Highlighted

Re: Why isn't my lookup command working?

SplunkTrust
SplunkTrust

Can you please explain "not showing exact number" ? what value are you expecting and what values you are getting?

0 Karma