topic Lookup command can take wildcard(*) as an input. in Splunk Search

Lookup command can take wildcard(*) as an input.

vranjith009 — Tue, 29 Sep 2020 09:05:06 GMT

Suppose i have a lookup with two fields input and output.

Initial,Final
abc*,abc
def*,def

so anything matches with abc* should give abc as output. Similarly anything matches with def* should give def as output.

Added csv file in lookups file of particular app.
Created transforms.conf in local folder and added below lines.
[abc]
filename = abc.csv

I m not getting anything with the below query.

index=* sourcetype=* | lookup abc Initial OUTPUT Final

Thanks in advance

JMichaelis — Fri, 11 Mar 2016 13:55:35 GMT

vranjith009 — Mon, 21 Mar 2016 12:10:58 GMT

Thanks Michaelis... got the answer