I ran into something like this today, also with a csv lookup table for OUIs. In my case, it turned out some of the vendors listed in the wireshark source had double quotes in the name, causing thousands of lines in between the errant quotes to be ignored.
This is an old thread, but in case it helps someone, you can compare the file to what splunk parses out of it. Compare "| inputlookup oui.csv" in splunk (note the leading pipe) with "wc -l oui.csv" in the shell. Splunk will say "0 matching events" but should have a count below listed as "X results". This should be one off of wc's count (due to the header).
You can also try to track down where data is missing by aggregating sections of the file/table and comparing, e.g.:
cut -b 2-2 oui.csv|sort | uniq -c
vs
| inputlookup oui.csv | rex field=oui "^(?<firstchar>.).:" | top firstchar limit=16| sort firstchar
... View more