why lookup with outputnew doesn't work, when configured in props.conf

[marcokrueger]

Hi,
I have a search with two lookups
... | lookup user_agent_filter OUTPUT botstatus | lookup ipnet_filter cidr AS ip OUTPUTNEW botstatus | ...
this works fine, but if I put it in my props.conf like
LOOKUP-user_agent_filter = user_agent_filter http_user_agent OUTPUT botstatus
LOOKUP-ipnet_filter = ipnet_filter cidr AS ip OUTPUTNEW botstatus

only the first filter works. There is no result from the second.
Is there a order or something like this how to put rules in the props.conf?

best regards
Marco

[somesoni2]

As per the splunk documentation,

"OUTPUTNEW behavior has changed since 4.1.x (where none of the output fields were
written to if any of the output fields previously existed)"

[marcokrueger]

Okay, can you tell me, why it works in the search but if I configure it in the props.conf it doesn't work, as in the question asked? 😉
Best regards