I have configured a field lookup on our test server to return a readable name for event codes in our logs. Doing so with a TA app, so I have a folder with the proper subfolders containing my confs, the csv for the lookup, and local/default.meta. This works just fine in our test environment, and places a field in the left sidebar that displays the readable names in the logs returned while searching.
We decided to move this to production, and have not had success. Our production environment has two indexers, two search heads serving different purposes, and an app deployment server. When we deployed the TA to our production environment to the search head we use to query splunk we originally encountered errors in the props, and transforms.conf that needed to be fixed. Having done that the errors cleared, yet we do not get a field containing readable names for the event codes in our logs. Are there any differences between a 'monolithic' and distributed search environment that would prevent a lookup from one working on the other?
