I have a lookup working when I use "lookup" manually in my search. I cannot seem to get this working as an automatic lookup though.
This search works and returns the lookup fields
sourcetype=ivrdata | WHERE IVR_Message="Phone" | rename IVR_Value AS areacode | rex field=areacode mode=sed "s/(\d{3})(\d{3})(\d{4})/\1-\2/g" | table areacode | lookup AreaCodeLookup areacode
This search simply returns the areacodes but all other fields (city, region, etc) are blank
sourcetype=ivrdata | WHERE IVR_Message="Phone" | rename IVR_Value AS areacode | rex field=areacode mode=sed "s/(\d{3})(\d{3})(\d{4})/\1-\2/g" | table areacode city region latitude
My automatic lookup is defined as
AreaCodeLookup areacode AS phone_no OUTPUTNEW city country latitude AS _lat longitude AS _lng region
What am I missing here to get automatic lookup working?
It appears your lookup is dependent on a field that has not been extracted. Add areacode
to field extraction on your search head and try the auto lookup. The reason it works in the GUI is because you have a rex
to extract the field before the lookup