I have a KV Store with replicate turned on, a lookup definition with WILDCARD(match_field), and an automatic configured to output a numeric lookup_field. When I run a search on the relevant source ty...
See more...
I have a KV Store with replicate turned on, a lookup definition with WILDCARD(match_field), and an automatic configured to output a numeric lookup_field. When I run a search on the relevant source type, I see the lookup_field. However, when I search with the lookup_field (e.g., "lookup_field=1"), the search finishes quickly and doesn't return anything. This is an example of the lookup. mac,exception 00ABCD*,1 11EEFF*,1 This is an example of the lookup definition. WILDCARD(mac) This is an example of the automatic lookup. lookup mac_addresses mac OUTPUT exception Here is an example of a search that does not return the expected results: index=mac_index exception=1 Here's what's really strange. It works for some events, but not others. When I run this, I get five events earliest=7/29/2024:00:00:00 latest=7/30/2024:00:00:00 index=logs exception=1 When I run this (adding the manual lookup), I get 109 (which is accurate). earliest=7/29/2024:00:00:00 latest=7/30/2024:00:00:00 index=logs | lookup exception_lookup mac OUTPUTNEW exception | search exception=1 Any ideas of what could cause this? Any ideas on how to troubleshoot it?