Hi digitalX,
If I understand your request correct, you are after setting threshold in a lookup table. This can be achieved by using the match_type in transforms.conf to specify the field you want to match on as a wildcard, then populate your lookup table just like you've planned to.
transforms.conf :
[score]
filename = score.csv
match_type = WILDCARD(value)
And your score.csv :
mySearch,value,score
foo,5*,2
foo,10*,3
boo,30*,5
If you now use this run everywhere command you can get back the score based on the fake count which was made by the first eval command:
Count is 101
| gentimes start=-1 | eval count="101" | eval mySearch="foo" | lookup score value AS count mySearch AS mySearch
and the results will look like this:
Count is 55
| gentimes start=-1 | eval count="55" | eval mySearch="foo" | lookup score value AS count mySearch AS mySearch
and the result will look like this:
Bear in mind, this has some limits. Because the wild card match for 10* will work from 100 until 109, but also matches 1000 and/or 10000 for example!
Nevertheless I hope this helps and Grüess nach Chur 😉
cheers, MuS
Update after the comments:
Use this as score.csv
Search,lower,upper,score
foo,50,99,2
foo,100,999,3
foo,1000,9999,5
boo,50,99,20
boo,100,999,30
boo,1000,9999,50
and use it with inputlookup instead of lookup in the search:
| gentimes start=-1 | eval count="999" | eval mySearch="foo" | append [|inputlookup score ] | filldown count mySearch | where mySearch=Search AND count>=lower AND count<=upper
This should do what you need.
... View more
