Sorry I use underscores "_" in my variable names and this forum causes those to be italics instead! So I changed all of them to be hyphens "-"
I can do an inline lookup like this:
lookup sonicwall-app-id app-id as app OUTPUT app-name
but when I set it up as an automatic lookup like this:
lookup table: sonicwall-app-id
lookup input fields: app-id, app
lookup output fields: app-name, app-name
i had a similar issue. make sure that the sourcetype on the data returned matches the sourcetype in your automatic lookup definition
I was able to get this working. The search time lookup is configured a bit differently then the automatic lookup.
I'm having the same problem, I'm curious if you ever got this resolved and could post the fix.
what am I doing wrong in the automatic lookup thats preventing the automatic lookup from running?
What is your question?
BTW, you can use underscores by escaping them with '\' or by entering the variables as code.