Hi group,
Recently upgraded to 8.1.0.1 with single 'all-in-one' configuration. Yesterday I made a new line entry at the bottom of a long-used Lookup csv file and today it seemed to be ignored. We have a simple search that basically checks for unknown logins (see below)
index=msad
NOT [| inputlookup SIDLookup.csv | fields SID]
| dedup SID
Now, even when I searched with "| inputlookup SIDLookup.csv" the last entry did not show up. I then edited the file again and added a blank new line after my last entry and ensured 'word wrap' was off. The lookup file is only a four field lookup with nothing crazy (Name,SID,whenCreated,whenChanged). Each value is enclosed in Double-quotes and comma-separated with no spaces in between.
Every other entry is working fine... just not the last one. Trying to figure out where this is breaking down.
Thanks,
Greg
*** SOLVED *** Colleague of mine discovered that in the last Field Value of the Last Line entry I had sloppily eased up on the <SHIFT> Key and the Double Quote had became a Single Quote. Things like this can be difficult to spot, working remotely on small screen systems. Something to keep in mind... and as always it's nice to have a second pair of eyes on your work!
Best regards,
Greg
*** SOLVED *** Colleague of mine discovered that in the last Field Value of the Last Line entry I had sloppily eased up on the <SHIFT> Key and the Double Quote had became a Single Quote. Things like this can be difficult to spot, working remotely on small screen systems. Something to keep in mind... and as always it's nice to have a second pair of eyes on your work!
Best regards,
Greg