https://community.splunk.com/t5/Splunk-Search/Lookup-wildcard/m-p/563965#M196449 <P>up</P> Thu, 19 Aug 2021 14:57:58 GMT bosseres 2021-08-19T14:57:58Z https://community.splunk.com/t5/Splunk-Search/Lookup-wildcard/m-p/563041#M196163 <P>Hello,</P><P>I need a help with using wildcards in lookup.&nbsp;</P><P>I want to exclude from search results fields, which are located in lookup.</P><P>Example:</P><P>Search:&nbsp;host=*&nbsp; | search NOT [| inputlookup test_lookup.csv]<BR />Lookup test_lookup.csv containts two fields:</P><P>exe,comm</P><P><SPAN>/usr/sbin/useradd,*</SPAN></P><P>&nbsp;</P><P>I need to exclude all results which include exe="/usr/sbin/useradd" and any *comm* field.</P><P>I added WILCARD(comm) in lookup definitions, but it doesn't work.</P><P>transforms.conf</P><P>[test_lookup.csv]<BR />batch_index_query = 0<BR />case_sensitive_match = 1<BR />filename = test_lookup<BR />match_type = WILDCARD(comm)</P><P>&nbsp;</P><P>What I did wrong? Thank you.</P> Thu, 12 Aug 2021 09:24:57 GMT https://community.splunk.com/t5/Splunk-Search/Lookup-wildcard/m-p/563041#M196163 bosseres 2021-08-12T09:24:57Z https://community.splunk.com/t5/Splunk-Search/Lookup-wildcard/m-p/563161#M196220 <P>up</P> Fri, 13 Aug 2021 09:29:15 GMT https://community.splunk.com/t5/Splunk-Search/Lookup-wildcard/m-p/563161#M196220 bosseres 2021-08-13T09:29:15Z https://community.splunk.com/t5/Splunk-Search/Lookup-wildcard/m-p/563965#M196449 <P>up</P> Thu, 19 Aug 2021 14:57:58 GMT https://community.splunk.com/t5/Splunk-Search/Lookup-wildcard/m-p/563965#M196449 bosseres 2021-08-19T14:57:58Z