Administration Guide › Mapping and Parsing › How to Create a Data Mapping File

How to Create a Data Mapping File

You can use the mapping file wizard to create and edit Data Mapping files, which convert native events into refined events by mapping the parsed text string or field/value pairs to CEG-compatible fields. The mapping file wizard allows you to create and edit various types of mapping to accomplish this.

The process of creating or editing a DM file contains the following steps:

1. Opening the mapping file wizard.
2. Providing file details.
3. Locating and adding sample events using parsing files.
4. Setting direct mappings as needed.
5. Setting function mappings as needed.
6. Setting conditional mappings as needed.
7. Setting block mappings as needed.

   Note: You can set direct or function mappings using block mappings. They are an alternative to setting mappings with steps 4 and 5.

8. Analyzing and saving the completed DM file.

When creating a DM file, you should consider the data mapping priorities of the file itself, as well as the individual mapping types within the file. The completed DM file checks event information in the order of the mapping type screens (steps 4-7 in the wizard). If duplicate mapping types exist, the last value the DM file finds is the one assigned.

For example, if a DM file finds a Direct mapping for a given native event value, and then a different Conditional mapping for the same value, the refined event uses the Conditional mapping result.

Duplicate mappings within a given mapping type are handled differently, depending on the type:

• Direct Mappings and Function mappings -- The DM file uses the last matching value found. If a duplicate function mapping is found, the last function will be the one called. For example, you could set a duplicate mapping to call a second function if the first was not found or did not function as expected.
• Conditional mappings and Block mappings -- The DM file applies the first value found, and stops searching. To improve performance, you should place more common conditions earlier in the file for both these mapping types.

More information on the design implications of the mapping order is included in the individual mapping type procedures.