topic Re: How to add a wild card to all the field values at the end of a field? in Splunk Search

How to add a wild card to all the field values at the end of a field?

pavanae — Mon, 16 Apr 2018 18:43:51 GMT

I have a query as follows

| inputlookup hosts.csv | table host | format

Which gives the result as follows

( ( host="abc" ) OR ( host="def" ) OR ( host="ghi" ) OR ( host="jkl" ))

Now, how to modify my current query to get the result as follows

( ( host="abc*" ) OR ( host="def*" ) OR ( host="ghi*" ) OR ( host="jkl*" ))

Is there any way that I can add the wildcard to all the host field values either by eval or regex. Please let me know if there is any possibility?

Re: How to add a wild card to all the field values at the end of a field?

elliotproebstel — Mon, 16 Apr 2018 19:05:25 GMT

Very easy! Just do this:

| inputlookup hosts.csv 
| table host 
| eval host=host."*"
| format

That will append a wildcard to the end of the string in each host field.

Re: How to add a wild card to all the field values at the end of a field?

pavanae — Mon, 16 Apr 2018 19:11:50 GMT

worked perfect. Thank you @elliotproebstel

Re: How to add a wild card to all the field values at the end of a field?

elliotproebstel — Mon, 16 Apr 2018 19:24:09 GMT

Glad to help 🙂

Re: How to add a wild card to all the field values at the end of a field?

clintla — Wed, 02 Jan 2019 21:08:49 GMT

So if you use
| eval name1=upper(name1)."*"
| search host=name1

This should work right?

When I look at the field values- Name is exactly correct but when I use the name1 field it doesnt work.
if I swap it out with just the value- it works.. almost like the wildcard doesnt count if its in the field.