We have a standard configuration for our workstations. Several of the fields are static but some are dynamic (but these have a fixed length).
I want to use a lookup table of all the values and apply automatically to a sourcetype.
But I'm not sure how I would go about matching the fields/values with a Lookup Definition.
The standard is
1=Device Type - Static | 1 char |
2=Building Code - Static | 3 chars |
3=Department Code - Static | 3 chars |
4=Function - Static | 1 char |
5=Asset Tag - Dynamic | 7 chars |
So a machine may be named LBL1HRSSABC1234 indicating it's a laptop in Building 1 in HR Services that is Shared with an asset tag of ABC1234.
How could I use a lookup with these 4 static and 1 dynamic values to populate said values when a search is done on a particular host name.
I should mention that I'm confortable creating the lookup and applying it, just not how to get it to match on the criteria above.
Thanks in advance!
This is not a job for lookups. Use regex-based transformation.
"(?<device_type>.)(?<building_code>...)(?<department_code>...)(?<function>.)(?<asset_tag>.{7})"
This is not a job for lookups. Use regex-based transformation.
"(?<device_type>.)(?<building_code>...)(?<department_code>...)(?<function>.)(?<asset_tag>.{7})"
That worked like a charm! Thank you!