I have a question regarding lookup tables. I want to create a lookup that places the output in the same field as the input.
Let's say I have the following lookup table defined:
num,name
80,http
25,smtp
And the search returns a field named src_port with a value of 80.
I want a search that replaces the content of src_port with http. If the lookup doesn't produce any results then the original contents should remain.
This is what I've tried but it doesn't work. The result is that the field src_port is not available at all.
| lookup convert-portnum num AS src_port OUTPUT name AS src_port
However, the same search using a different output field produces the expected result.
| lookup convert-portnum num AS src_port OUTPUT name AS src_port_name
Has anyone gotten something like this to work?
Thanks
... View more