Problem solved! I found some " in the lookup file. Looks like the splunk lookup gets in trouble if only one " is appearing per lookup-file line. It results in strange behaviour as described above. The lines between a first single-" and the next " getting an null content. After letting sed delete all the " in the file, the lookup works fine! As I use a script to fill the lookup files it was easy to add the following sed command: sed -i 's/"//g' $LOOKUP_FILE Now every future lookup-file should be compatible. ... View more