https://community.splunk.com/t5/Splunk-Search/lookup-table-using-like-syntax/m-p/103810#M26845 <P>Thanks, worked like a charm!!!!</P> Thu, 17 Oct 2013 13:55:59 GMT rdownie 2013-10-17T13:55:59Z https://community.splunk.com/t5/Splunk-Search/lookup-table-using-like-syntax/m-p/103808#M26843 <P>If I have a lookup table that contains the following:<BR /> <PRE><BR /> mstring,category<BR /> %-mdfa,network<BR /> %-mdfb,network<BR /> %cam,camera<BR /> %-avaya,phone<BR /> </PRE><BR /> and I want to match it using a like syntax (SQL or where hostname like mstring) where I could have b01k-mdfa return network for category. Is there a way to do this with a lookup?</P> Thu, 17 Oct 2013 12:08:49 GMT https://community.splunk.com/t5/Splunk-Search/lookup-table-using-like-syntax/m-p/103808#M26843 rdownie 2013-10-17T12:08:49Z https://community.splunk.com/t5/Splunk-Search/lookup-table-using-like-syntax/m-p/103809#M26844 <P>Not using % as wildcard, but <CODE>*</CODE>. When you define your lookup table in transforms.conf, you can specify a <CODE>MATCH_TYPE</CODE>. Set this to <CODE>WILDCARD</CODE> and you will be able to lookup values using a table similar to yours. Something like</P> <PRE><CODE>mstring,category *-mdfa,network ... </CODE></PRE> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/admin/Transformsconf">http://docs.splunk.com/Documentation/Splunk/latest/admin/Transformsconf</A></P> Thu, 17 Oct 2013 13:20:50 GMT https://community.splunk.com/t5/Splunk-Search/lookup-table-using-like-syntax/m-p/103809#M26844 Ayn 2013-10-17T13:20:50Z https://community.splunk.com/t5/Splunk-Search/lookup-table-using-like-syntax/m-p/103810#M26845 <P>Thanks, worked like a charm!!!!</P> Thu, 17 Oct 2013 13:55:59 GMT https://community.splunk.com/t5/Splunk-Search/lookup-table-using-like-syntax/m-p/103810#M26845 rdownie 2013-10-17T13:55:59Z