I have following problem:
I have set disabled flag in ipintel by following query:
| inputlookup ipintel where key="js.arcgis.com"
| eval disabled="1"
| outputlookup append=true ipintel
After some time I discovered that disabled field value disappeared.
My question how I can monitor when and why value isn't anymore in its place.
I thought about using internal indexes.