lookup file not queried?

[wsw70]

Hello

I have a search which reports a field N_os (a string indicating an Operating System). I wanted values from this field to be grouped together via a specific logic, the best I could find was a lookup. Follwing the docs

I created my lookup file OSGroup.csv in /opt/splunk/etc/apps/MYAPP/lookups (tried both with double quotes and without):

N_os,OSGroup
"Microsoft Windows Server","Windows Server"
"Microsoft Windows 7","Windows Client"
"Microsoft Windows XP","Windows Client"
"AIX 5.1","AIX"

This file is referenced in /opt/splunk/etc/apps/MYAPP/local/transforms.conf:

[OSGroup]
filename = OSGroup.csv

I restarted splunk.

I then expected that a search

... | lookup OSGroup N_os OUTPUT OSGroup as N_osgroup

creates a field N_osgroup. I do not know how the match is done (by substring, only if there is an exact match, ...) so I added one line to the csv file which contains a sample of the exact value of N_os (so that it matches - this is the "AIX" one). Unfortunaty the search proceeds as usual (no errors) but N_osgroup is not created on the left-side fields bar.

Thank you in advance for any pointers!

[aweitzman]

You're welcome. Comment is copied to answer.

[wsw70]

@aweitzman: this is it! I did look at all fields but now realized that Splunk 6 does not show all fields even when one chooses this option. It is only after I selected "All fields" on teh top, then again "all fields" in the chooser (which only shows fields > 1%) than it appeared. Thank you (could you please copy your comment into an answer so that I can accept it?). I will open a new question on wildcard fields in the .csv lookup file (it would be a shame if it was not possible)

[aweitzman · Accepted solution]

1. You definitely don't need double quotes in the csv file, and it has to be an exact match.

2. Your search as described in your question should work. However, just because you mention the field in your search doesn't mean it will show up on the left. Splunk may have decided in its infinite wisdom that it is not an "interesting" field, and you will have to either (Splunk 5) click on the "View all 327 fields" link at the bottom or (Splunk 6) click on the "All Fields" link at the top, to see it show up. (You can then add it to the list of selected fields so you don't have to do that each time.)

[wsw70]

Yes, I did try with and without the double quotes

[Ayn]

Did you try all this with lookups without double quotes? I don't remember 100% but I think that Splunk will try to match on everything including the quotes unless you have quotes in the corresponding header as well.