I have a lookup table with user data called id_lookup.csv
username,hostname,ip
user1,computer1,1.1.1.1
user2,computer2,2.2.2.2
user3,computer3,3.3.3.3
I use that lookup table to help populate identity data for a search like this
index=myindex sourcetype=mysourcetype
| search username=*
| lookup local=true id_lookup.csv username OUTPUT hostname,ip
| table hostname, ip, username
The issue is that the table of results doesn't get populated with the 2 fields I'm searching in the lookup for all the results when the users I'm searching the lookup table for are definitely in there.
So my results will look like this:
hostname,ip,username
, ,user1
computer2,2.2.2.2,user2
, ,user3
But if I search the lookup table using inputlookup
| inputlookup id_lookup.csv
| search username="user1"
I get the results
username,hostname,ip
user1,computer1,1.1.1.1
And when running a 1 off search using the lookup command for further testing I get the same inconsistent results
| makeresults
| eval username="user1"
| lookup local=true id_lookup.csv username OUTPUT hostname, ip
| table hostname, ip, username
Which gives
hostname,ip,username
, ,user1
All the fields match up, permissions check out, transforms.conf looks right for that particular lookup stanza.
Does anyone know what else I can do to troubleshoot or know if this is a possible bug? The only thing I can think of is the csv file is fairly large but it still doesn't make sense why it would return the results for some entries and not others.
... View more
