I have a CSV lookup made up of two columns. IP address is the key and a customer name is the value. I believe the lookup is working correctly as I can use it to decorate the source field in the search results but I’m wanting to create a new field for customer rather than just decorating the results so I’m using a pipeline for that. But for some reason it only ever returns the default value set in the lookup table.
Below is my pipeline rule.
rule "Customer Lookup" when has_field("source") then let c = lookup_value("Customer Lookup", to_string($message.src_addr)); set_field("Customer", c); end