I have created a lookup table with name simple.csv
The lookup table has fields as
Text, Name
Launched application: Automatic Registration, Automatic Registration
Launched application: Bone Mineral Density, Bone Mineral Density
Launched application: Comp. Cardiac, Comp. Cardiac
The Text value in the data is actually as
Launched application: Bone Mineral Density, PID 345 or
Launched application: Bone Mineral Density, PID 941 or
Launched application: Comp. Cardiac, now start or
Launched application: Comp. Cardiac, now stop
What i want is that it should search the specified Text as mentioned in the search and should fetch the Name specified against it from the Lookup table and give the desired Name in the table
i.e. the value in Text field of the lookup table has some part of Text that is to be matched with the Text in the actual data. Since both the fields are not having the same values i am not getting the required result.
while searching I am using
sourcetype=philips_client_logs Text="Launched application: Automatic Registration"|table Text|join[inputlookup simple.csv]*
kindly suggest what to do .
Thanks in advance.
... View more