Is there a way for Lookup file to return field names?

[ansif]

Is there a way to achieve this?

I have  a lookup table with 2 columns alert_type and short_description.

alert_type | short_description

cpu              | "The Host".host."cpu utilization is high".cpu_perc."%"

mem            | "The memory in the host ".host."is high with a percentage of ".mem_perc."%"

When alert type matches it should return short_description and the fields in the short description should replace with field values( host,cpu_perc and mem_perc)

Example :

The Host abcd.com cpu utilization is high 90 %

instead of a string

"The Host".host."cpu utilization is high".cpu_perc."%"

[bowesmana]

You can't do that and, for example, use printf(short_description, ...) but you could use a series of replace statements, e.g.

| lookup lookup_file.csv alert_type OUTPUT short_description
| eval msg=replace(short_description, "mem_perc", mem_perc)
| eval msg=replace(msg, "host", host)
| eval msg=replace(msg, "cpu_perc", cpu_perc)

You could put that all in a macro if you wanted re-use and just change the macro as needed. 

[ansif]

Is there a way to do an iterate using foreach or something to replace?

Like all  fields in the short_description which needs to replace is prefix with "var_" , thus a foreach to replace all var_* with *?

[bowesmana · Accepted solution]

Yes you can do

| lookup lookup_file.csv alert_type OUTPUT short_description
| eval msg=short_description
| foreach mem_perc host cpu_perc [ eval msg=replace(msg, "<<FIELD>>", <<FIELD>>) ]

Note that here, the 'host' will get replaced twice, as there are two "host" strings. So, you may want to surround your replacement anchors with some identifer, e.g. if your description is

"The memory in the host {host} is high with a percentage of {mem_perc}%"

then use

| foreach mem_perc host cpu_perc [ eval msg=replace(msg, "{<<FIELD>>}", <<FIELD>>) ]

[ansif]

| makeresults
| eval host="abc.com",mem_perc="32",short_description="The memory in the host {host} is high with a percentage of {mem_perc}%"
| eval msg=short_description
| foreach host mem_perc cpu_perc
[ eval msg=replace(msg, "{<<FIELD>>}", <<FIELD>>) ]

The above woks however if the field is not available then it is not working. For example cpu_perc is not available above so it is showing blank in msg

[bowesmana]

Test for null and use some standard text, i.e.

| foreach host mem_perc cpu_perc
  [ eval _tmp=if(isnotnull('<<FIELD>>'), '<<FIELD>>', "Unknown"), 
         msg=replace(msg, "{<<FIELD>>}", _tmp) 
    | fields - _tmp ]