just ran into the issue posted here:
which mentions another post with a similar issue that was also not answered.
I’ve stopped and started the graylog server to see if that would fix the issue but it did not.
Anyone have any ideas?
If not, I’ll open a support case
He @cawfehman could you please phrase your exact question with a few words?
Because it is not clear if you want to have the source of your messages with a hostname or if you want something with a decorator. That would help to help you.
Sorry… yeah… rereading that makes me question what I wanted too.
TL;DR the lookup table is now working and available as a choice in the drop down when trying to configure a decorator.
The issue I was having was the I was trying to create a decorator to perform a reverse DNS lookup on the srcIP in the syslog message. I created the data adapter, then I created the cache (no cache), and then I created the lookup table.
Once I created the lookup table, I went to my search, selected the decorators tab, selected lookup table from the drop down, clicked apply and in the configuration window where it asks you to select the lookup table you want, the newly created lookup table was not listed.
I assumed the list wasn’t refreshed, so I logged out and back in. Still wasn’t there… stopped and started graylog… still wasn’t there… gave up… created a bad community post and went to bed. Came in this morning and went to pick the troubleshooting back up, but now the lookup table was there.
I guess there is a delay from the time the lookup table is created to when it’s available.
Thanks for replying Jan, do you know if there is such a delay, or should a lookup table be available right away. There was at least an hours worth of time that elapse from creating the lookup table to finally giving up.
Thanks again
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
