Add description to field value

[phildefer]

Hello, 

I have a system log which contains different DNS error messages (in the 'Message' field) and I am looking for an easy way to provide a short, meaningful description for those messages, either by adding a new field representing each unique DNS error message, or by adding text to the Message field.

Here's an example; one event contains the following : 
Message="DNS name resolution failure (sos.epdg.epc.mnc720.mcc302.pub.3gppnetwork.org)"

This error is related to WiFi calling, so I would like to associate a description, or tag to that specific message, e.g. "WiFi calling".

Thoughts?

[bowesmana]

Depending on how many cases you have, you can either do it inline, with

| eval description=case(match(Message, "regex_expression1"), "Description1",
                        match(Message, "regex_expression2"), "Description2",
                        match(Message, "regex_expression3"), "Description3")

or probably more practical is to make a lookup - probably a wildcard based lookup, which means creating a CSV with Message, Description fields and then a lookup DEFINITION that has the match type set to 

WILDCARD(Message)

In that you could then put things like

"DNS name resolution failure*" as the Message column and then a suitable description.

Using a wildcard type means you don't have to write SPL to extract particular bits of the message to determine the lookup attribute.