I want to insert a different regex string into my query for each host. I am thinking that a way to achieve this is by making a lookup into a CSV to retrieve the regex string, allocating to a new field, and then inserting it further on in the query.
Is this possible or ridiculous?
Thanks for your advice
That's entirely possible. Say your lookup looks like this:
host,expression
A,foo
B,bar
Add your lookup to your data as automatic, and search like this:
base search | where match(some_field, expression)
That would filter to only keep events where the host-based expression matches some_field.
expression
is the field produced by the automatic lookup.
Thanks. How would I get the regex statement into expression?