Hello,
I am working to put together an app which will be deployed to our search head. In the app, there is a lookup csv file located in < APPNAME>/Lookups. I need the app to lookup a single field, and append the corresponding field to each event. Inside the event there is an extracted field called "Termination_Cause." In the csv file we have this format:
"Termination_Cause","Termination_Cause_Description"
"01","Term_Value"
"02","Term_Value2"
So using that example, when the Termination_Cause field is 01, we need the Termination_Cause_Description field to be added to the event with the value "Term_Value" while retaining the original Termination_Cause field.
I am looking at the props conf documentation and I just need to clarify the syntax because the way it is documented is a little confusing to me. Before this I had always done lookups using the GUI, and just need some guidance on what to put in props.conf and transforms.conf.
Thanks in advance!
