For this my ultimate goal is to set up a automatic lookup for a source type. Set this to Global also
I set up the the automatic lookup as such
lookup table = Fulton_ip_Lookup
sourcetype="\"uberAgent:Script:NetworkHops\""
Lookup input fields = computerip = IpAddress
The raw data looks like this
IpAddress="10.89.64.11"
When I use this code I get results
index=uberagent* sourcetype="\"uberAgent:Script:NetworkHops\""| lookup Fulton_ip_Lookup computerip as IpAddress OUTPUT SiteName | table IpAddress SiteName
10.89.64.11 Duluth Test Site
10.89.64.11 Duluth Test Site
But when I take the code away the SiteName doesn't show up.
Not sure what to check.
