I know this is old, but it's the first Google result. A workaround is Calculated fields can use |eval lookup(). The lookup must be a .csv file on the search head(s).   https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/definecalcfields https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/ConditionalFunctions ... View more

After filing a case the solution was to change all cef fields with * as their data types to string datatype in the app ... View more