Hi, I was hoping to use a lookup table to add some fields but it doesn't seem to do quite what I was hoping.
I have the following file, lookup.csv:
timestamp,host,env
2010-02-28 17:26:00,host1,dev
2010-02-28 16:50:00,host2,uat
2010-02-28 16:34:00,host1,uat
and I would like events from host1 to have the field env=uat for events up until 17:26 and env=dev for events after that. Instead all events have the field env=dev.
My transforms.conf looks like:
[mylookup]
filename = lookup.csv
time_field = timestamp
time_format = %Y-%m-%d %H:%M:%S
default_match = unknown
case_sensitive_match = false
Is this expected? Is there another way to achieve what I'm looking for?
Thanks
The stanza above should be in transforms.conf, since it defines the lookup table. To make it apply for a given sourcetype, you should add to props.conf:
[<sourcetype>]
LOOKUP-env = mylookup host OUTPUT env
Editing to include new findings:
1298942760,host1,dev
and take out the time_format attribute in transforms.conf.Are you sure that you're looking at data from 2010 and not 2011?
The stanza above should be in transforms.conf, since it defines the lookup table. To make it apply for a given sourcetype, you should add to props.conf:
[<sourcetype>]
LOOKUP-env = mylookup host OUTPUT env
Editing to include new findings:
1298942760,host1,dev
and take out the time_format attribute in transforms.conf.Are you sure that you're looking at data from 2010 and not 2011?
Yes, that did it. Changing to the correct year (!) and using UTC time everything now works.
Thanks!
Thanks Stephen, actually the stanza is in transforms.conf and I have the correct entry in props.conf I've corrected my question.