Getting Data In

match_type wildcard not working for automatic lookup

Explorer

Please any help will be appreciated.
We have a lookup test_pci_asset.csv with a field nt_host
values of nt_host are host1 host2

Raw log in splunk host fields are host1.abc.com

We are trying to use automatic lookup to match the host field so when we run a query it can pull back host1.abc.com as host.
We tried the following with WILDCARD(nt_host) but no luck. Props and transforms below

props.conf
[default]
LOOKUP-test_pci_asset.csv = test_pci_asset nt_host AS host OUTPUTNEW bunit category city ip owner

transforms.conf
[test_pci_asset]
batch_index_query = 0
case_sensitive_match = 0
filename = test_pci_asset.csv
match_type = WILDCARD(nt_host)

0 Karma
1 Solution

Ultra Champion

Your lookup needs to contain the wildcard.
Enter the hosts in your lookup file as host1*, host2*

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

You cannot get features of a lookup definition if you reference the filename.csv. Create the lookup definition then use that name in the lookup command.

0 Karma

Ultra Champion

Your lookup needs to contain the wildcard.
Enter the hosts in your lookup file as host1*, host2*

View solution in original post

0 Karma

Explorer

Thank you @nickhillscpl

|inputlookup pci_asset_lists.csv | eval nt_host=nt_host."*" | outputlookup pci_asset_lists.cs
I added * to the nt_host list with tquery above and still not working. Any ideas why?

0 Karma

Explorer

Actually i had to wait for a while. Its working. thanks

0 Karma

Explorer

|inputlookup pci_asset_lists.csv | eval nt_host=nt_host."*" | outputlookup pci_asset_lists.csv

sorry mistake in previous query

0 Karma

Ultra Champion

You need to use the lookup definition. You can not use a CSV file directly for a wildcard search.

Test it works like this:

<your search> |lookup test_pci_asset nt_host as host OUTPUTNEW bunit category city ip owner
0 Karma

Ultra Champion

also - check the lookup is as you expect:
|inputlookup test_pci_asset do the hotsnames include *

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!