Hi
I am trying to define a new transform.conf in SPLUNK 7 so that a lookup can take a wild character.
The initial MXTIMING_lookup_Base is working, so i copied it and added a 1 to the end.
I then ran the refresh, to reload the transform.conf, however they wont reload.
http://dell425srv:8000/en-GB/debug/refresh?entity=admin/transforms-lookup
http://dell425srv:8000/en-GB/debug/refresh?entity=admin/transforms-extract
http://dell425srv:8000/en-GB/debug/refresh
[MXTIMING_lookup_Base]
filename = MXTIMING_BASE.csv
match_type = WILDCARD(Context_Command)
[MXTIMING_lookup_Base1]
filename = MXTIMING_BASE1.csv
match_type = WILDCARD(Context_Command)
Perhaps i am missing something, but this used to refresh in SPLUNK 6
Any help is great thanks
Robert Lynch
