Splunk Search

lookup not working. Help pls

gitingua
Communicator

Now working lookup 

On a local server on my computer, I got the result

 

Снимок экрана 2021-10-21 в 13.58.17.png

But when I did exactly the same actions on the production server. one to one. Then there is no result

Снимок экрана 2021-10-21 в 13.02.34.pngСнимок экрана 2021-10-21 в 13.03.09.pngСнимок экрана 2021-10-21 в 13.03.31.png

 

examples in the photo, one user at a time. no result for everyone.
where could i go wrong? Thanks! 

Splunk Version 7. 

both files have global mode

 

0 Karma

efavreau
Motivator

Check lookup definition in both places, csv in both places, permissions on both - in both places. Then run the exact same query in both places.

###

If this reply helps you, an upvote would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The screenshots do not show the lookup file containing an address or CIDR range that matches 10.10.10.10.  Is there such an entry?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...