i have been starring at this problem for yons but stuck
i have two dynamic lookups.
1. volumeCheck (external lookup), fields defined=ip, volumes, vrank
Result; volumeCheck always return vrank=UNK . I expect vrank to be GREEN or AMBER
2. top10InboundPortProtocol (external lookup), fields defined=port,protocol,rank
Result: returns GREEN, AMBER or RED (works)
I checked the logs and I can see that volumeCheck is returning on the stdout RED or GREEN but on splunk search, it is showing vrank=UNK. I can't see any exception or error in splunkd.log
FYI, i set in the dynamic lookup, minimum matches=1, Default matches to UNK
I have done many dynamic lookups but this one stumbled me.
FYI my splunk query
index="flowintegrator" src_port=21 |eval thisUser=src_ip + "_"+ dest_ip | bucket _time span=1d | eval diff= floor((now() - _time)/86400) |eval diff="row"+diff | chart avg(bytes) over thisUser by diff|eval row1=if(isnull(row1), 0, floor(row1))| eval row2=if(isnull(row2), 0, floor(row2))|eval row3=if(isnull(row3), 0, floor(row3))|eval row4=if(isnull(row4), 0, floor(row4))|eval row5=if(isnull(row5), 0, floor(row5))|eval row6=if(isnull(row6), 0, floor(row6))|eval volumes=row1+";"+row2+";"+row3+";"+row4+";"+row5+";"+row6|**lookup volumeCheck ip as thisUser, volumes OUTPUT vrank**
Help.
↧