I was able to fix this by doing the following: Export the lookup table from Splunk Open this in Notepad++ and select Encoding > Encode in UTF-8 Add the lookup to Splunk ... View more

Typically when I see this question, it is an issue of indexing latency/lag. The search is on a cron schedule to run every 2 minutes and looks over the last 125 seconds of events. If the event wasn't indexed until it was 200 seconds old, for example, it won't be picked up by the search. We typically recommend adding in a buffer to account for index latency/lag. You could use this eval to determine the time difference between index time and event time: |eval indextime=_indextime |eval bkt=_bkt |eval delay_sec=_indextime-_time |table indextime _time delay_sec bkt | rename _time as Eventtime | convert ctime(*time) If you happen to find the latency for an event is 2 1/2 minutes, for example, you may want to adjust the search to look back 3 to 6 minutes: This takes into account any latency between index time and event time. Basically allowing enough time to pass so that when the search is run you know the data will be there. ... View more