Using Lookups in Splunk with CASE statements

[JuhiSaxena]

I am using CASE statements to evaluate value of msgcode variable below. Can this set of CASE-like statements be replaced with a lookup in Splunk?

eval msgcode=CASE(Error LIKE "%Not a valid path to a statistics probe%","1", Error LIKE "%invalid message size%maximum size expected was%","1",Error LIKE "%eartbeat manager is disconnecting an unresponsive%","1",Error LIKE "%attempted to publish a message larger than the sow store slab size size and the processing of that message has been aborted%","1", Error LIKE "%sow%error%","1",Error LIKE "%transaction log unable to execute journal action%","1",Error LIKE "%client reaper detected a client which has not been reaped %","1",Error LIKE "%HTTP interface to statistics is currently unavailable%","1",Error LIKE "%waiting for %to complete%","1",Error LIKE "%Failed to parse the query string%","1",Error LIKE "%" ,"0") | eval Time=strftime(_time, "%m/%d %H:%M:%S") | table Time,Error,host,sourcetype,count,msgcode | dedup Time,Error,host,sourcetype,count,msgcode | eval trigger=CASE (msgcode==0, "yes", msgcode==1 AND count>=3,"yes",msgcode==1 AND count<3,"no") | where trigger="yes"

[koshyk]

If using front-end UI Search
I'm not aware of match options within a lookup.

**If using backend conf **
If you are using "conf" files You could do completely avoid eval-CASE to a certain based based on lookup file with normal lookup and/or wildcard lookup (MATCH_TYPE). But this is NOT possible to avoid a value in between the string,

In Summary, i don't think you can avoid CASE statement that easily as per your example strings.

[starcher]

Yes. Look at making a wildcard lookup.
https://docs.splunk.com/Documentation/Splunk/7.1.1/Knowledge/Addfieldmatchingrulestoyourlookupconfig...

MATCH_TYPE=wildcard(Error)