Troubleshooting lookups

If you are having problems with a lookup, very often the cause lies within permissions. Check permissions at all three of these paths:

  • Settings | Lookups | Lookup table files
  • Settings | Lookups | Lookup definitions
  • Settings | Lookups | Automatic lookups

Once permissions are squared away, be sure to keep the following points in mind:

  • Check your spelling of the fields.
  • By default, lookup values are case-sensitive.
  • If your installation is using multiple indexers, it may take some time for the lookup files and definitions to be distributed to your indexers, particularly if the lookup files are large or you have installed many apps that have assets to be distributed.
  • A rule of thumb is that a lookup file should not have ...

Get Implementing Splunk 7 - Third Edition now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.