I am trying to set up an enrichment based on the "user" field in my source data; I want to enrich events with data from Active Directory.
I have exported the data to CSV and loaded it successfully (it seems) into HBase using the flatfile_loader.sh script, BUT...
All the examples I have seen appear to load the data into the enrichment table in HBase. Does it matter that I have created a new table / do I need to do anything in particular to pull enrichment data from my new table / should I have just used the enrichment table?
After a bare minimum of testing it seems the answer is: Yes, I do need to use the enrichment table in HBase. However this is by no means an authorative answer.