If, as pdevlin guesses, you have one lookup attached to the host, and one lookup attached to the sourcetype, then the intersection of these will only perform ONE of these two lookups.
That is:
- data that matches the host will get the host lookup.
- data that matches the sourcetype will get the sourcetype lookup
- data that matches both will only get the host lookup
This is by design. When you name your lookup "LOOKUP-table" you're essentially saying that this is the lookup which achieves some purpose or action described by "table". When you define it differently in different stanzas, this means that you wish the lookup to operate differently in different cases. Typically this is when you want the lookup to happen one way for most data (a default) but for some app, or some data source, etc you want to override how this is handled.
In your case, these lookups achieve different goals. One seems to be intended to determine something about logs per day, while the other seems to be something about location. You might want:
[host::machine_name]
LOOKUP-logsperday = logs_per_day host OUTPUTNEW average_logs AS logs_per_day
[sendmail]
LOOKUP-location = location host OUTPUTNEW building AS location
Now you have two different settings which are not intended to collide. You know more about what these lookups do, so you can probably give them more descriptive class names.
