Using wildcards * in lookup csv files

andreac81 — Mon, 15 May 2017 10:43:14 GMT

Hi to all,
I'm using a csv file to categorize event actions extracted by a log file.

I'm extracting events action (i.s. getxxx) using a regular expression, then I use the lookup command to search the action in the csv file and to extract the relative category.

Since the event action is like IP/getxxx and the IP is variable, I'd like to set the csv file like */getxxx in order to match for any IP, but the * in the csv file doesn't work.
How can i solve?

Thanks,
Andrea

Re: Using wildcards * in lookup csv files

aakwah — Mon, 15 May 2017 13:34:34 GMT

Hello,

have a look to this answer:
https://answers.splunk.com/answers/52580/can-we-use-wildcard-characters-in-a-lookup-table.html

Another option: as long as you are extracting the action using regex, so why not extract it without the IP 🙂

Regards

topic Re: Using wildcards * in lookup csv files in Getting Data In

Using wildcards * in lookup csv files

Re: Using wildcards * in lookup csv files