adding fallback ("others") to a lookup table

[wsw70]

Hello,

Following up on the excellent answer to my question about (essentially) using a lookup table, I wonder how to deal with events not referenced in the lookup table. Namely I have a lookup table

product,vendor
MS,Microsoft
Microsoft,Microsoft
Adobe,Adobe
Flash,Adobe

It works fine, but the only events available after a lookup are the ones which match the lookup table. This means that the other ones are discarded -- I would like to keep them, though, and assign them to a vendor "other" (a fallback category, so to speak). Essentially I would be looking for a lookup table like

product,vendor
MS,Microsoft
Microsoft,Microsoft
Adobe,Adobe
Flash,Adobe
*,others

I know that this is not the correct way to build the table, I just wanted to give an idea about the sought result 🙂
I use this lookup directly from the search field (as of now).

Thanks!

[gkanapathy · Accepted solution]

Another approach (in addition to default_match as mentioned by MickSheppard, and in addition to evaluating afterwards) is tospecify in your lookup defintion that a certain field is matched using wildcards. In transforms.conf in the lookup table definition:

[mylookuptablename]
filename=mylookupfile.csv
match_type=WILDCARD(product)

This will then let your above CSV match using the "*" wildcard. (Partial wildcard matches are also possible.)

[wsw70]

One final question: what do you mean by "Partial wildcard matches are also possible"?

The * wilcard on its own works fine.
I tried * Java * to catch both "Oracle Java something" and "Sun Java something" but the match does not work
(there is no space between the stars and the word Java, otherwise the comment system interprets this as "Java in italics")

[wsw70]

All the solutions work fine - thanks a lot!
This one (subjectively) is the most versatile one - but thanks a lot to everyone for helping 🙂

It's a shame more than one answer cannot be marked as the right one...

[MickSheppard]

I've been using the default matches section of the lookup for that. If something doesn't exist in my lookup table it takes the defaults.

[dwaddle]

One approach is to use an eval to fix it after the fact.

... | eval vendor=coalesce(vendor,"others")

[wsw70]

Thank you! This does the trick