topic Re: wildcard matching in lookup input in Splunk Search

wildcard matching in lookup input

RSS_STT — Mon, 06 Jan 2025 10:45:05 GMT

Can i do the wildcard matching in lookup?

|makeresults
|eval ip=192.168.101.10

|lookup ip.csv ip output host

In my lookup i have two entry ip=192.168.101.10 & ip=192.168.101.10/24.

How can i add wildcard (*) for match and i should get two entry.

gcusello — Mon, 06 Jan 2025 10:54:10 GMT

in [Settings > Lookups > Lookup Definitions ] open "Advanced Options" and configure CIDR as match_type, as described at https://docs.splunk.com/Documentation/Splunk/9.4.0/Knowledge/Addfieldmatchingrulestoyourlookupconfiguration

Ciao.

Giuseppe

RSS_STT — Mon, 06 Jan 2025 10:57:08 GMT

what if i want to match host_name= abc & host_name=abc_123 which is in lookup file.

gcusello — Mon, 06 Jan 2025 10:59:12 GMT

in the same option of the same section try with WILDCARD instead CIDR.

Ciao.

Giuseppe

ITWhisperer — Mon, 06 Jan 2025 11:10:50 GMT

The wildcard need to be defined in the lookup e.g. abc* will match abc and abc_123

RSS_STT — Mon, 06 Jan 2025 11:50:03 GMT

could you please help with SPL syntax to match wild card entry.

Jawahir — Mon, 06 Jan 2025 18:44:20 GMT

ITWhisperer — Mon, 06 Jan 2025 12:50:07 GMT

If you have wildcards in your lookup, just use the lookup command