Dashboards & Visualizations

How can I search using an inputlookp with wildcards and spaces?

humanBeing
Engager

I'm trying to search for a string from a lookup table that has wildcards and spaces.  

For example, if I have a field named firewall_string_field that has the following value:

random text randomtext random My File Name With Spaces.doc random randomrandom

My lookup table named my_special_lookup.csv

Field1
"*My File Name With Spaces.doc*"
"*Second File Name With Spaces.doc*"

 

My query looks like:

index=firewall [|inputlookup my_special_lookup.csv | fields Field1 | rename Field1 AS firewall_string_field]


I get no results.  

I get results if I do a simple search like:

index=firewall firewall_string_field="*My File Name With Spaces.doc*"


I tried creating a lookup definition with matchtype WILDCARD(Field1) but am still getting no results.  

0 Karma

marysan
Communicator

@humanBeing 
If your problem is resolved, then please click one of the "Accept as Solution" buttons to help future readers. 🙂

0 Karma

marysan
Communicator

this must work :
index=firewall
|lookup my_special_lookup.csv  Field1 as firewall_string_field


richgalloway
SplunkTrust
SplunkTrust

When troubleshooting queries containing subsearches it helps to start with the subsearch alone and add the |format command on the end.  This will show what the subsearch is returning to the main search and (hopefully) give a clue about what should be changed to get the desired results.  In this case, simply adding the format command should do it.

index=firewall [
  | inputlookup my_special_lookup.csv 
  | fields Field1 
  | rename Field1 AS firewall_string_field 
  | format
]
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...