https://community.splunk.com/t5/Getting-Data-In/How-to-create-automatic-wildcard-lookups-against-more-than-one/m-p/163205#M33088 <P>Can also be done in the same lookup definition as..<BR /> example:<BR /> [MandiantAPT]<BR /> filename = mandiant-apt.csv<BR /> case_sensitive_match=false<BR /> match_type = WILDCARD(domain),WILDCARD(filename)</P> Tue, 29 Sep 2020 16:20:04 GMT gunzola 2020-09-29T16:20:04Z https://community.splunk.com/t5/Getting-Data-In/How-to-create-automatic-wildcard-lookups-against-more-than-one/m-p/163202#M33085 <P>Hi,</P> <P>I have defined a Automatic Lookup to a CSV File with several values per line.<BR /> I would create automatic wildcard lookups against more than one field in the csv. Is this possible?</P> <P>I have tried the following but not successful:</P> <P>props.conf</P> <PRE><CODE>[squid] LOOKUP-MandiantAPT = MandiantAPT domain AS uri_host OUTPUTNEW LOOKUP-MandiantAPT = MandiantAPT filename AS uri_path OUTPUTNEW </CODE></PRE> <P>transforms.conf</P> <PRE><CODE>[MandiantAPT] filename = mandiant-apt.csv case_sensitive_match=false match_type = WILDCARD(domain) match_type = WILDCARD(filename) </CODE></PRE> <P>mandiant-apt.csv</P> <PRE><CODE>domain,description,isbad,md5,filename,filesize,stringlist "*advanbusiness.com*","Mandiant APT",true,"*001dd76872d80801692ff942308c64e6*","*121.exe*","*10233*","*!@#%$^#@!*" "*aoldaily.com*","Mandiant APT",true,"*002325a0a67fded0381b5648d7fe9b8e*","*162.exe*","*10240*","*@***@*@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@*" </CODE></PRE> <P>Has anyone an idea? Thank you in advance for your help.<BR /> Regards,<BR /> Patrik</P> Wed, 30 Jul 2014 11:09:17 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-create-automatic-wildcard-lookups-against-more-than-one/m-p/163202#M33085 psidler 2014-07-30T11:09:17Z https://community.splunk.com/t5/Getting-Data-In/How-to-create-automatic-wildcard-lookups-against-more-than-one/m-p/163203#M33086 <P>You should just set up two different lookups (pointing to the same file)</P> <PRE><CODE>[squid] LOOKUP-MandiantAPTd = MandiantAPTd domain AS uri_host OUTPUTNEW LOOKUP-MandiantAPTf = MandiantAPTf filename AS uri_path OUTPUTNEW [MandiantAPTd] filename = mandiant-apt.csv case_sensitive_match=false match_type = WILDCARD(domain) [MandiantAPTf] filename = mandiant-apt.csv case_sensitive_match=false match_type = WILDCARD(filename) </CODE></PRE> Thu, 31 Jul 2014 04:11:24 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-create-automatic-wildcard-lookups-against-more-than-one/m-p/163203#M33086 gkanapathy 2014-07-31T04:11:24Z https://community.splunk.com/t5/Getting-Data-In/How-to-create-automatic-wildcard-lookups-against-more-than-one/m-p/163204#M33087 <P>Works perfect!<BR /> Thank you for your help. Patrik</P> Thu, 31 Jul 2014 05:53:55 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-create-automatic-wildcard-lookups-against-more-than-one/m-p/163204#M33087 psidler 2014-07-31T05:53:55Z https://community.splunk.com/t5/Getting-Data-In/How-to-create-automatic-wildcard-lookups-against-more-than-one/m-p/163205#M33088 <P>Can also be done in the same lookup definition as..<BR /> example:<BR /> [MandiantAPT]<BR /> filename = mandiant-apt.csv<BR /> case_sensitive_match=false<BR /> match_type = WILDCARD(domain),WILDCARD(filename)</P> Tue, 29 Sep 2020 16:20:04 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-create-automatic-wildcard-lookups-against-more-than-one/m-p/163205#M33088 gunzola 2020-09-29T16:20:04Z