I have a variable portion of a log file that is structured, all IDs are numeric. There are over 100K possible different IDs. It is not a fixed set of IDs, so coding individual field names doesn't work.
[id-1=cnt-1, id-2=cnt2, id-3=cnt3, ...,id-n=cnt-n]
this is parsed as
| rex field=stats max_match=100 "(?\d*=\d*)"
I want to replace the numeric id-n with a name from a table. I have the dbx lookup defined that provides
id-n, name.
Thanks from a newbie
Thanks,
I goofed on copy the parse
rex field=stats max_match=100 "(? kvpair \d*=\d*)"
with angle brackets around kvpair
I usually start a search with |dbxquery
and end it with | outputlookup MyLookup
and schedule this to run every evening. Then I just use |lookup MyLookup
in searches.