https://community.splunk.com/t5/Splunk-Search/wildcard-in-lookup-file/m-p/55091#M13464 <P>Did you look into <A href="http://splunk-base.splunk.com/answers/52580/can-we-use-wild-characters-in-lookup-table">this</A> Question?</P> Tue, 19 Mar 2013 15:50:15 GMT bjoernjensen 2013-03-19T15:50:15Z https://community.splunk.com/t5/Splunk-Search/wildcard-in-lookup-file/m-p/55090#M13463 <P>Hi,<BR /> My transform file:</P> <PRE><CODE> [taskname] REGEX = \b(Task\w+)\b FORMAT = taskname::$1 props.conf REPORT-taskname = taskname lookup file: error, solution taskname, abcdef </CODE></PRE> <P>this query works as I want:</P> <PRE><CODE> "Task*" "exception" | join error [ inputlookup lookupfile.csv | fields error, solution | rename apperror as taskname ] | table _time, source, taskname, solution </CODE></PRE> <P>however: if I change transforms file like this:</P> <PRE><CODE> [taskname] REGEX = \b(Task\w+)\b FORMAT = taskname::$1 match_type = WILDCARD(stname) and in lookup file: error, solution taskname*, abcdef </CODE></PRE> <P>Above query won't work. the doc says we can use wildcharacter but I am not getting what I am doing wrong. Can someone please help?</P> Thu, 07 Mar 2013 23:30:15 GMT https://community.splunk.com/t5/Splunk-Search/wildcard-in-lookup-file/m-p/55090#M13463 gudavasr 2013-03-07T23:30:15Z https://community.splunk.com/t5/Splunk-Search/wildcard-in-lookup-file/m-p/55091#M13464 <P>Did you look into <A href="http://splunk-base.splunk.com/answers/52580/can-we-use-wild-characters-in-lookup-table">this</A> Question?</P> Tue, 19 Mar 2013 15:50:15 GMT https://community.splunk.com/t5/Splunk-Search/wildcard-in-lookup-file/m-p/55091#M13464 bjoernjensen 2013-03-19T15:50:15Z