Categorize host_names based on list

[mmacdonald70]

I apologize if this has been answered before. I couldn't find it anywhere.

I am trying to use the Nagios addon and app to create some reports for management. At the moment, I am working on Ping availability. The issue that I have is that we would like to only include a specific group of devices in these reports.

Is there a way to add a field or tag to this data so that:

if hostname = (device1 or device 2 or device 2) set TAG=LOCATION1
if hostname = (device3 or device4) set TAG = LOCATION2
else set TAG = OTHER

[jcoates_splunk]

I would add a lookup for this purpose. You could then do

hostname,categorytag
device1,LOCATION1
device2,LOCATION1
device3,LOCATION2
device4,LOCATION2
*,OTHER

That last line needs the WILDCARD option in your transforms.conf definition.