Hello:
I’m having some difficulty understanding applying a lookup table decorator to a Stream. I have read the documentation on decorators and I’m familiar with LUTs because we use them elsewhere, but I can’t seem to get the decorator to do anything.
For example, I’ve configured the lookup table to map an identifier (12345) to a name (host01). The messages in the stream identify the host by identifier, but I want the stream to display “host01” instead of “12345”. So, I created a lookup table decorator with the source field “message” and the destination field “message” with the hope that when I view the stream the decorator will apply the transformation to the view but it is not doing anything. I have tried creating custom searches, tweaking options, etc.
I think I must be fundamentally misunderstanding how this decorator should work. I appreciate any help.
Thanks,
Andrew