i've got a strange issue regarding lookup tables. ((and seen in two lookup tables now)
I have a lookup table "serialnr.csv" containing
This is also setup in props.conf and transforms.conf
in my index only the serialnumber is seen, and recognized as serialnumber
my serach contains :
index=myindex | lookup serialnr.csv serialnumber as serialnumber output host as hostname | table serialnumber, hostname
output looks like
all info is shown and this works well for several months.
I added 1 line in serialnr.csv with the info of serialnr 25
so serial.csv now contains
when i do the same search i get blank fields behind serialnumber 25, where at all other serialnumbers all info is shown.
output is now
When doing a stats, based on the result of the lookup, than the record of serialnr 25 will not show at all in the result.
I have the same issue with another lookup table.
I restarted all splunk servers we have in use.
still the issue remains
it must be something simple, but i can't figure out what. (and in the meantime our reports are missing information)
Who has a clue ?