I have implemented an automatic lookup by specifying the filename in transforms.conf:
[host_info]
filename = host_info.csv
and also defining the lookup in props.conf:
[source::*]
LOOKUP-host_info_for_windows = host_info host OUTPUTNEW ip,site,subnet
This is working for most sources, however I notice it is not working for my scripted input sources. It simply does not display the ip and site fields for those sources. Do I have to configure anything special for the automatic lookup to apply to the scripted input sources?
I ended up just explicitly calling a lookup for the scripted input sources. Not the most ideal solution, but it works.
search xxx | lookup host_info.csv host OUTPUTNEW ip |