updated link ... View more

Thank you - this was exactly what I was trying to figure out.  I had a regex and couldn't figure out why only part of it was disappearing.  I didn't understand about the capture group. ... View more

Similar setup to drfk, with no macro but 2 lookups.  Splunk 8.2.2.  Verbose mode gave results, but Fast/Smart modes just resulted in 0's.  Changing the limits.conf file fixed the problem.  Thank you! ... View more

Right, but it should work.  In my dataset, the events will either have productId or Code, but not both.  If I don't specify OUTPUT, then after the first lookup anything with a productId should given a Code (and a price).  When the second lookup is run, it should affect every event (every event will have a Code at that point) giving everything a productPrice (overwriting the ones that already had a price from the first lookup).  But in reality after the 2 lookups, nothing has a productPrice (all counts are 0) ... View more

No, unfortunately not.  When I try this, then all of my counts go to 0.  I'm pretty sure the problem here is that it's trying to match 2 input fields for each event.  In my case, the events will either have 1 field or the other, but not both ... View more

I found a solution, just not sure I understand why.  I had to specify the output field:   index=main (sourcetype="vendor_sales" OR sourcetype="access_combined_wcookie") | lookup productDetails productId AS productId OUTPUT productPrice | lookup productDetails productCode AS Code OUTPUT productPrice | timechart count(productPrice) by sourcetype   The problem has something to do with the overlap in fields.  When the OUTPUT is not specified, every field besides the one used for INPUT is added to events.  So that means for events with a productId, both the productPrice and productCode fields were added.  And for events with a Code field, both productPrice and productId were added.  But the new productCode and productId fields somehow interfere with each other, breaking the entire search. Because if I try to make all events have all 3 fields (id, code and price), I do this:   index=main (sourcetype="vendor_sales" OR sourcetype="access_combined_wcookie") | lookup productDetails productCode AS Code OUTPUT productPrice productId | lookup productDetails productId AS productId OUTPUT productPrice productCode | timechart count(productPrice) by sourcetype   and then all counts go to 0.   Update: The solution listed above only works with a Verbose search.  If I switch to a Fast or Smart Search, the counts go back to 0.  I think maybe the solution to this is "don't use 2 lookups..."   Update 2 This is a known issue detailed here.  The real solution was to change my limits.conf file - that fixed everything. ... View more