Hello
Following up on a previous question about lookups I am looking for a way to either use or simulate wildcards in a .csv lookup file.
I have fields like
Microsoft Windows 8.1 Pro
Microsoft Windows 8 Pro
Microsoft Windows 7 Ultimate
Microsoft Windows 7 Professional
Microsoft Windows 7 Enterprise
which I would like to group under, say, Windows Clients
via a lookup. I do not know in advance what the values will be, so ideally I would like to be able to say
Microsoft Windows 7*,Windows Client
Microsoft Windows 8*,Windows Client
which does not work as is (and was hinted so by aweitzman in his answer.
The alternate solution I can think about would be to use an external script for the lookup which would get the field value and output something, based on a logic/algorithm within the script (as opposed to a csv)
You might be able to adapt something like the following:
search-goes-here | eval OSGroup=case(match(OSName,"Microsoft Windows 7(.*)"),"Windows Client", match(OSName,"Microsoft Windows 8(.*)"),"Windows Client",match(OSName,"Microsoft Windows Server(.*)"),"Windows Server")
The second argument to each match
function is a regex, and the case
statement lets you line up your matches with your output values.
While you can't put these in CSV files, you can turn the eval
clause into a macro (add it to macros.conf
) and refer to it wherever you need it.
You might be able to adapt something like the following:
search-goes-here | eval OSGroup=case(match(OSName,"Microsoft Windows 7(.*)"),"Windows Client", match(OSName,"Microsoft Windows 8(.*)"),"Windows Client",match(OSName,"Microsoft Windows Server(.*)"),"Windows Server")
The second argument to each match
function is a regex, and the case
statement lets you line up your matches with your output values.
While you can't put these in CSV files, you can turn the eval
clause into a macro (add it to macros.conf
) and refer to it wherever you need it.
Hmmm... it looks like there's more to transforms.conf than I realized.
You can put wildcards in the CSV file, and then add the following term to the appropriate stanza in transforms.conf and it will work:
match_type = WILDCARD(OSName)