topic Re: How are values in lookups matched? in Splunk Search

How are values in lookups matched?

gkanapathy — Thu, 18 Mar 2010 04:19:40 GMT

When a field value is passed to a lookup, what are the limits on how it can match the value in the lookup? Specifically:

Is the match case-sensitive? If not, what locale rules are used? Similarly, is it diacritic-sensitive?
Are any kinds of wildcards allowed? Can I use, e.g., * or Prefix-* in a lookup table and expect it to match an event field value like Prefix-1?

Re: How are values in lookups matched?

steveyz — Fri, 09 Apr 2010 00:33:43 GMT

Matches are case sensitive as well as diacritic-sensitive.

No wildcards are allowed at this time.

Re: How are values in lookups matched?

Jason — Fri, 13 Jul 2012 16:45:40 GMT

As of Splunk 4.2(?), transforms.conf allows you to specify both case_sensitive_match and match_type to set the behavior of field matching in lookups:

case_sensitive_match = <bool>
* If set to false, case insensitive matching will be performed for all fields in a lookup table
* Defaults to true (case sensitive matching)

match_type = <string>
* A comma and space-delimited list of <match_type>(<field_name>) specification to allow for non-exact matching
* The avaiable match_type values are WILDCARD, CIDR, and EXACT.  EXACT is the default and does not need to be specified.  Only fields that should use WILDCARD or CIDR matching should be specified in this list

case_sensitive_match applies to all fields in the lookup.

What match_type means, if I remember correctly, is that if you have field1=foobar in your event, and a lookup file with a foo* line in it, match_type = WILDCARD(field1) will make foobar match foo*.

Re: How are values in lookups matched?

lguinn2 — Thu, 26 Jul 2012 18:42:56 GMT

This is true by default, but you can now change this to some degree.

Re: How are values in lookups matched?

bsayatovic — Mon, 25 Feb 2013 18:38:20 GMT

What about a prefixed wildcard instead of suffix? e.g. will a lookup file with a "*bar" line in it, match_type = WILDCARD(field1) match "foobar"? I've tried this but can't get it to work, but maybe I've done something else wrong.

Re: How are values in lookups matched?

sinvin — Thu, 30 Sep 2021 19:16:34 GMT

Hey @bsayatovic ,
Did you happen to find a solution for the prefix wildcard? I am running into same issue, so wondering if you found a way around it.