Autolookup strangeness - 2 fields not returning - several others are - explicit inline lookup works - what should I look at?

[snoobzilla]

So I have a couple of chained auto lookups. For some reason 2 fields in the second lookup are not returning when all the others are. Only 1 input value for second lookup. All values in lookup are non-null. Explicit inline lookup of same fields works. They happen to be named COMMENT and Client_Impact.

Anyone have any similar experiences or wisdom to share? Are there character/formatting issues I should look for?

Ideas and feedback appreciated.

Thinking maybe it was a hidden/bad character issue, I went through and retyped the values for Client_Impact and reuploaded using sideview lookup updater.

I am going to try deleting and recreating the lookup file.

[snoobzilla · Accepted solution]

Lesson learned... look for competing lookups.

I found a competing old global autolookup conflict which was causing the issue. It explicitly called those fields as output and did not have values in the lookup it was referencing. When this was removed the issue was addressed.

Thanks for the feedback.

[snoobzilla]

Is this what you are looking for?

Autolookup - servicelog : LOOKUP-FIXIT2_METADATA_AUTO

FIXIT2_METADATA KER OUTPUT APR APR_STATUS ASKIT CALLS_VIS COMMENT Call_Tip Cause_Type Client_Impact DEFECT INC PRB

All the other fields work except for COMMENT and Client_Impact.

[rsennett_splunk]

It's possible that you can see the settings but not alter them.
Click Settings (upper right hand corner of GUI) and see if "lookups" is present on the left hand side.
Then EDIT your answer and add the definition.

[snoobzilla]

I am not an admin. I don't know if I have access or if I do how to get there. Will get with my splunk admin unless there is a way to get there from web interface.

[martin_mueller]

Do post the LOOKUP-foo lines from props.conf.