Thanks for responding.
I looked at the CSV and the "appId" field is not quoted; in the database (using DB Connect Input Service) the "RELATED_AIT_NUMBER" the field is defined as an int.
I have a workaround for now by modifying my query to join on the app table in the database and aliasing the field so my searches don't break. I'm thinking that there must be a way to tell how Splunk sees the fields. When I figure this out, I will post the solution here.
... View more