What is the best way to assign multiple eventtypes to a field from a comma-separated list?

[arkadyz1]

Our input data has a field named conditions, which is comma-separated list. We wanted to assign eventtypes to the events according to the list inside. For example, conditions="WeightOK,TooBig" would result in the event having two eventtypes: WeightOK and TooBig.

What would be the most efficient way of doing it? I don't think we could just have an evaluated field in props.conf/transforms.conf called eventtypes, could we? Eventtypes are normally defined in eventtypes.conf. Would it work if we created a search-time calculated field, say, mv_conditions=split(conditions,",") and then used

[app-%mv_conditions%]
search = <our search>

in eventtypes.conf? And if yes, would it be efficient?

[arkadyz1 · Accepted solution]

After a lot of experiments, I found that we'll have to:
a) tokenize the conditions field with TOKENIZER = ([^,]+) in fields.conf
b) resort to have all known conditions converted to eventtypes individually like this:

[WeightOK]
search = conditions=WeightOK

etc.

We are still checking the performance, even though it must already be better than our former search = conditions=*WeightOK*