Splunk Search

lookup not working. Help pls

gitingua
Communicator

Now working lookup 

On a local server on my computer, I got the result

 

Снимок экрана 2021-10-21 в 13.58.17.png

But when I did exactly the same actions on the production server. one to one. Then there is no result

Снимок экрана 2021-10-21 в 13.02.34.pngСнимок экрана 2021-10-21 в 13.03.09.pngСнимок экрана 2021-10-21 в 13.03.31.png

 

examples in the photo, one user at a time. no result for everyone.
where could i go wrong? Thanks! 

Splunk Version 7. 

both files have global mode

 

0 Karma

efavreau
Motivator

Check lookup definition in both places, csv in both places, permissions on both - in both places. Then run the exact same query in both places.

###

If this reply helps you, an upvote would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The screenshots do not show the lookup file containing an address or CIDR range that matches 10.10.10.10.  Is there such an entry?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...