Archive
Highlighted

How to use dbx to lookup Ids?

Explorer

I have a variable portion of a log file that is structured, all IDs are numeric. There are over 100K possible different IDs. It is not a fixed set of IDs, so coding individual field names doesn't work.
[id-1=cnt-1, id-2=cnt2, id-3=cnt3, ...,id-n=cnt-n]

this is parsed as
| rex field=stats max_match=100 "(?\d=\d)"

I want to replace the numeric id-n with a name from a table. I have the dbx lookup defined that provides
id-n, name.

Thanks from a newbie

Tags (1)
0 Karma
Highlighted

Re: How to use dbx to lookup Ids?

Esteemed Legend

I usually start a search with |dbxquery and end it with | outputlookup MyLookup and schedule this to run every evening. Then I just use |lookup MyLookup in searches.

0 Karma
Highlighted

Re: How to use dbx to lookup Ids?

Explorer

Thanks,
I goofed on copy the parse
rex field=stats max_match=100 "(? kvpair \d=\d)"
with angle brackets around kvpair

0 Karma