lookup command not working while inputlookup working

[Mrig342]

Hi All,

I have a .csv file  named Master_List.csv added to splunk lookup. It has the values of the fields "Tech Stack", "Environment", "Region" and "host" and has about 350 values per field. After adding the lookup table, inputlookup command is working fine and is giving the output table.

But when I am using lookup command in the below query, I am not getting the fields in the output on the left-hand side even though all the required permissions have been provided:

index=tibco_main sourcetype="NON-DIGITAL_TIBCO_INFRA_FS"  | regex _raw!="^\d+(\.\d+){0,2}\w"
| regex _raw!="/apps/tibco/datastore"
| rex field=_raw "(?ms)\s(?<Disk_Usage>\d+)%"
| rex field=_raw "(?ms)\%\s(?<File_System>\/\w+)"
| rex field=_raw "(?P<Time>\w+\s\w+\s\s\d+\s\d+\:\d+\:\d+\s\w+\s\d+)\s\d"
| rex field=_raw "(?ms)\d\s(?<Total>\d+(\.\d+){0,2})\w\s\d" | rex field=_raw "(?ms)G\s(?<Used>\d+(\.\d+){0,2})\w\s\d"
| lookup Master_List.csv "Environment"

Can someone please guide me on how to get the lookup command working or help modify the command.

Thank you..

[Mrig342 · Accepted solution]

Hi ITWhisperer,

I tried with "host" too instead of "Environment". It didn't work either. Can you suggest why..?

[ITWhisperer]

What values for host do you have in your events and what values do you have in you csv file? Perhaps there is a mismatch?

[Mrig342]

Hi ITWhisperer,

There is no mismatch between the hosts available in the events and the csv file. However, now I am able to see the fields coming up and the lookup command is working fine. Don't know how it worked now, but seems my requirement is fulfilled.

Thank you.

[ITWhisperer]

You don't appear to have an Environment field extracted, should you be looking up by host instead?