If I have a lookup table that contains the following:
mstring,category
%-mdfa,network
%-mdfb,network
%cam,camera
%-avaya,phone
Not using % as wildcard, but *
. When you define your lookup table in transforms.conf, you can specify a MATCH_TYPE
. Set this to WILDCARD
and you will be able to lookup values using a table similar to yours. Something like
mstring,category
*-mdfa,network
...
http://docs.splunk.com/Documentation/Splunk/latest/admin/Transformsconf
Not using % as wildcard, but *
. When you define your lookup table in transforms.conf, you can specify a MATCH_TYPE
. Set this to WILDCARD
and you will be able to lookup values using a table similar to yours. Something like
mstring,category
*-mdfa,network
...
http://docs.splunk.com/Documentation/Splunk/latest/admin/Transformsconf
Thanks, worked like a charm!!!!