Hi,
I have a search with two lookups
... | lookup user_agent_filter OUTPUT botstatus | lookup ipnet_filter cidr AS ip OUTPUTNEW botstatus | ...
this works fine, but if I put it in my props.conf like
LOOKUP-user_agent_filter = user_agent_filter http_user_agent OUTPUT botstatus
LOOKUP-ipnet_filter = ipnet_filter cidr AS ip OUTPUTNEW botstatus
only the first filter works. There is no result from the second.
Is there a order or something like this how to put rules in the props.conf?
best regards
Marco
As per the splunk documentation,
"OUTPUTNEW behavior has changed since 4.1.x (where none of the output fields were
written to if any of the output fields previously existed)"
Okay, can you tell me, why it works in the search but if I configure it in the props.conf it doesn't work, as in the question asked? 😉
Best regards