Hi,
My transform file:
[taskname]
REGEX = \b(Task\w+)\b
FORMAT = taskname::$1
props.conf
REPORT-taskname = taskname
lookup file:
error, solution
taskname, abcdef
this query works as I want:
"Task*" "exception" | join error [ inputlookup lookupfile.csv | fields error, solution
| rename apperror as taskname ] | table _time, source, taskname, solution
however: if I change transforms file like this:
[taskname]
REGEX = \b(Task\w+)\b
FORMAT = taskname::$1
match_type = WILDCARD(stname)
and in lookup file:
error, solution
taskname*, abcdef
Above query won't work. the doc says we can use wildcharacter but I am not getting what I am doing wrong. Can someone please help?
Did you look into this Question?