Can do search time lookup but automatic lookup not working

[jalfrey]

Sorry I use underscores "_" in my variable names and this forum causes those to be italics instead! So I changed all of them to be hyphens "-"

I can do an inline lookup like this:

lookup sonicwall-app-id app-id as app OUTPUT app-name

but when I set it up as an automatic lookup like this:

---

lookup table: sonicwall-app-id

lookup input fields: app-id, app

lookup output fields: app-name, app-name

[mlconnor]

i had a similar issue. make sure that the sourcetype on the data returned matches the sourcetype in your automatic lookup definition

[jalfrey]

I was able to get this working. The search time lookup is configured a bit differently then the automatic lookup.

• After adding the lookup table you need to change the permissions so it's at least shared with the app.
• In my app I have a custom sourcetype for my data so I had to select that or it would not work.
• The last snag I hit was the variable names. The first value is the variable name from the .csv file. The second is the variable from splunk data. If you get the backwards it won't work. Actually you'll get an error that it couldn't find the field. I recommend leaving the rest blank and it will auto export the rest of the variables from the .csv file.

[jeremiahc4]

I'm having the same problem, I'm curious if you ever got this resolved and could post the fix.

[jalfrey]

what am I doing wrong in the automatic lookup thats preventing the automatic lookup from running?

[richgalloway]

What is your question?

BTW, you can use underscores by escaping them with '\' or by entering the variables as code.