If we have some error messages with some static and dynamic content. We want to match static content of error to interesting fields of splunk search by editing lookup table with regex please suggest a possible solution here.
error:
Connection timed out 65143
static content : Connection timed out
dynamic content : 65143
You could try defining WILDCARD lookups in the lookup definition for the field e.g.
Connection timed out *