I would like to have iplocation fields added to all events when they're ingested and have verified the lookup works in the search app. I've done something similar with dnsLookups in props.conf, but doing the same for iplocation doesn't appear to function the same. Here's what I've tried in my props.conf:
LOOKUP-iplocation_src = iplocation prefix=src_ allfields=true srcip
LOOKUP-iplocation_dst = iplocation prefix=dst_ allfields=true dstip
With that I get: "The lookup table 'iplocation' does not exist." when searching. Do I need to reference the iplocation lookup in my transforms.conf
Thanks.
↧