Getting Data In

why lookup with outputnew doesn't work, when configured in props.conf

marcokrueger
Path Finder

Hi,
I have a search with two lookups
... | lookup user_agent_filter OUTPUT botstatus | lookup ipnet_filter cidr AS ip OUTPUTNEW botstatus | ...
this works fine, but if I put it in my props.conf like
LOOKUP-user_agent_filter = user_agent_filter http_user_agent OUTPUT botstatus
LOOKUP-ipnet_filter = ipnet_filter cidr AS ip OUTPUTNEW botstatus

only the first filter works. There is no result from the second.
Is there a order or something like this how to put rules in the props.conf?

best regards
Marco

0 Karma

somesoni2
SplunkTrust
SplunkTrust

As per the splunk documentation,

"OUTPUTNEW behavior has changed since 4.1.x (where none of the output fields were
written to if any of the output fields previously existed)"

0 Karma

marcokrueger
Path Finder

Okay, can you tell me, why it works in the search but if I configure it in the props.conf it doesn't work, as in the question asked? 😉
Best regards

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...