Hi fellow Splunkers, I am trying to use DB-Connect to enrich search results by doing a dbxlookup against a table. This is my command: | makeresults | eval value_i_know_to_be_in_database="218024571471" | dbxlookup query="SELECT * FROM my_table" connection="my_connection" DATABASE_FIELDNAME as value_i_know_to_be_in_database OUTPUT CONTENT as dbx_content For all I know this is exactly in line with the documentation. To verify that i did not goof the query i also ran: | dbxquery query="SELECT * FROM my_table" connection="my_connection" | outputlookup dbxtest.csv This returns results and looks right. I added it to my previos search like this: | makeresults | eval value_i_know_to_be_in_database="218024571471" | dbxlookup query="SELECT * FROM my_table" connection="my_connection" DATABASE_FIELDNAME as value_i_know_to_be_in_database OUTPUT CONTENT as dbx_content | lookup dbxtest.csv DATABASE_FIELDNAME as value_i_know_to_be_in_database OUTPUT CONTENT as lookup_content Now I get the expected value in the lookup_content field and still nothing in the dbx_content field. I have been at this problem for multiple hours now and can't seem to get anywhere. I also tried to use a predefined lookup (which in actual production I can not use because my query needs to be dynamic). Did not work either. At this point I don`t know what else to try. I have read the docs forward and back, but I can not get anything. Help me answers.splunk. You are my only hope. ... View more