Please any help will be appreciated.
We have a lookup test_pci_asset.csv with a field nt_host
values of nt_host are host1 host2
Raw log in splunk host fields are host1.abc.com
We are trying to use automatic lookup to match the host field so when we run a query it can pull back host1.abc.com as host.
We tried the following with WILDCARD(nt_host) but no luck. Props and transforms below
LOOKUP-test_pci_asset.csv = test_pci_asset nt_host AS host OUTPUTNEW bunit category city ip owner
batch_index_query = 0
case_sensitive_match = 0
filename = test_pci_asset.csv
match_type = WILDCARD(nt_host)
Thank you @nickhillscpl
|inputlookup pci_asset_lists.csv | eval nt_host=nt_host."*" | outputlookup pci_asset_lists.cs
I added * to the nt_host list with tquery above and still not working. Any ideas why?
You need to use the lookup definition. You can not use a CSV file directly for a wildcard search.
Test it works like this:
<your search> |lookup test_pci_asset nt_host as host OUTPUTNEW bunit category city ip owner