<div dir="ltr">Is it possible to substitute a value after a pattern match? For example, in the pattern below if I match the "23" then use value "telnet", but if it is a "22", then "ssh".<br><br>%SEC_LOGIN-4-LOGIN_FAILED: Login failed [user: test] [Source: 131.212.1.1] [localport: 23] [Reason: Login Authentication Failed] at 10:38:41 CST Thu Jan 23 2014<br><br>I am trying to use one pattern to match both cases and we'd prefer to have service names rather than port numbers in our db.<br><br clear="all"><div><div><div><div><div><div dir="ltr"><div><div dir="ltr"><div>--</div>Mark Shetka<br>Infrastructure Analyst - Network Team<br>Information Technology Systems & Services<br>University of Minnesota - Duluth<br><a href="tel:%28218%29%20726-7682" value="+12187267682" target="_blank">(218) 726-7682</a></div></div></div></div></div>
</div></div></div></div>