Hi, i am trying the App "Lookup File Editor" and have problems with the match_type settings. Normal lookups can be configured to use match_type=CIDR or something else. I cant find similar settings in the "Lookup File Editor" app from splunkbase. Do i something wrong or is this feature not included?   Thanks   ... View more

Hello * how can i overwrite the default eval definition for field app in props.conf? default/props.conf   ... EVAL-app = "Blue Coat ProxySG" ...   I try to overwrite this field with following in local/props.conf   ... FIELDALIAS-app = x_bluecoat_application_name as app ...   We use a distributed Environment so i changed this in SH and HF app. But no change to the results. What am i doing wrong? ... View more