As the other responder said, I would set up an automatic pivot for the CSV file. You could then use a wildcard on the pivoted data field to ignore the rest of the string. This link can be used for instructions on how to setup lookups: ... View more

There is a known issue for this when you specify a deployment server address during installation. My workaround was to leave the deployment server empty at install time and then use "set deploy-poll" from the cli after installation, and then restart the forwarder. In my case the issue was happening in 6.5.2 but I think the issue exists in older versions as well. ... View more