https://community.splunk.com/t5/Splunk-Search/using-match-type-wildcard-in-lookup-not-working/m-p/463232#M195684 <P>Please any help will be appreciated. <BR /> We have a lookup test_pci_asset.csv with a field nt_host<BR /> values of nt_host are host1 host2</P> <P>Raw log in splunk host fields are host1.abc.com</P> <P>We are trying to use automatic lookup to match the host field so when we run a query it can pull back host1.abc.com as host.<BR /> We tried the following with WILDCARD(nt_host) but no luck. Props and transforms below</P> <P>props.conf<BR /> [default]<BR /> LOOKUP-test_pci_asset.csv = test_pci_asset nt_host AS host OUTPUTNEW bunit category city ip owner</P> <P>transforms.conf<BR /> [test_pci_asset]<BR /> batch_index_query = 0<BR /> case_sensitive_match = 0<BR /> filename = test_pci_asset.csv<BR /> match_type = WILDCARD(nt_host)</P> Wed, 30 Sep 2020 04:03:40 GMT btawiah 2020-09-30T04:03:40Z https://community.splunk.com/t5/Splunk-Search/using-match-type-wildcard-in-lookup-not-working/m-p/463232#M195684 <P>Please any help will be appreciated. <BR /> We have a lookup test_pci_asset.csv with a field nt_host<BR /> values of nt_host are host1 host2</P> <P>Raw log in splunk host fields are host1.abc.com</P> <P>We are trying to use automatic lookup to match the host field so when we run a query it can pull back host1.abc.com as host.<BR /> We tried the following with WILDCARD(nt_host) but no luck. Props and transforms below</P> <P>props.conf<BR /> [default]<BR /> LOOKUP-test_pci_asset.csv = test_pci_asset nt_host AS host OUTPUTNEW bunit category city ip owner</P> <P>transforms.conf<BR /> [test_pci_asset]<BR /> batch_index_query = 0<BR /> case_sensitive_match = 0<BR /> filename = test_pci_asset.csv<BR /> match_type = WILDCARD(nt_host)</P> Wed, 30 Sep 2020 04:03:40 GMT https://community.splunk.com/t5/Splunk-Search/using-match-type-wildcard-in-lookup-not-working/m-p/463232#M195684 btawiah 2020-09-30T04:03:40Z