I have SNMP logs that come in with a large variety of keyvalue pairs. The key side is translated at the trap level on the OS in order to have a human readable key. The problem is that the value side is just an integer (like an enum that references some possible set of values for that key). I have a lookup file that maps the fieldname to a human readable value/definition. Most of the keys all follow a similar part with a prefix to them being 'cpq'.
Is there any way to perform a lookup (auto or otherwise) on each of the actual field names that are auto-parsed during search time?
Is there a way I can get Splunk to (auto)lookup all the field names that start with cpq for a definition in some lookup file? Or does this require more logic that would have to be taken care of in a modular inputs type thing?