Hi Glory
I've tried this on my system and managed to get it to work in the following way.
Define only three input parameters for the RFCLookup function. You can hardcode IP_CAT, ELEMLENGTH (suggest the maximum value that you expect from the different ELEMENT coming in) and TYPE.
Here is the mapping and how the queues look like. Please make sure for Item you have the same number of values as the different context that will appear in ELEMENT and VALUE. Easiest way to achieve this is to map it from the parent segment of ELEMENT or VALUE.
This is a sample of the alert generated from the above test.
NOTE: I tried having ELEMLENGTH as an input for the function but somehow it did not work. I think sometimes this RFCLookup function is a bit buggy!
Please try this out and let me know how it goes.
Rgds
Eng Swee