Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

Automatic Lookup to Overwrite Field Value at Search Time

$
0
0

I am trying to overwrite a field that is boolean. I created a table to convert 1/0 to IN/OUT so that the data is more human readable.

Below is my props.conf entry.

[source::mysource]
LOOKUP-mylookup = lookup_table direction_inbound AS direction_inbound OUTPUT direction AS direction_inbound

I have tried:

LOOKUP-mylookup = lookup_table direction_inbound AS direction_inbound OUTPUTNEW direction AS direction_inbound

with no positive results. Transforms.conf has the path to the csv. The lookup works if I create a new field, but I want to overwrite the field that is already there.

Any idea what I might be missing.


Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>