Getting Data In

match_type wildcard not working for automatic lookup

Bentash
Explorer

Please any help will be appreciated.
We have a lookup test_pci_asset.csv with a field nt_host
values of nt_host are host1 host2

Raw log in splunk host fields are host1.abc.com

We are trying to use automatic lookup to match the host field so when we run a query it can pull back host1.abc.com as host.
We tried the following with WILDCARD(nt_host) but no luck. Props and transforms below

props.conf
[default]
LOOKUP-test_pci_asset.csv = test_pci_asset nt_host AS host OUTPUTNEW bunit category city ip owner

transforms.conf
[test_pci_asset]
batch_index_query = 0
case_sensitive_match = 0
filename = test_pci_asset.csv
match_type = WILDCARD(nt_host)

0 Karma
1 Solution

nickhills
Ultra Champion

Your lookup needs to contain the wildcard.
Enter the hosts in your lookup file as host1*, host2*

If my comment helps, please give it a thumbs up!

View solution in original post

0 Karma

starcher
SplunkTrust
SplunkTrust

You cannot get features of a lookup definition if you reference the filename.csv. Create the lookup definition then use that name in the lookup command.

0 Karma

nickhills
Ultra Champion

Your lookup needs to contain the wildcard.
Enter the hosts in your lookup file as host1*, host2*

If my comment helps, please give it a thumbs up!
0 Karma

Bentash
Explorer

Thank you @nickhills

|inputlookup pci_asset_lists.csv | eval nt_host=nt_host."*" | outputlookup pci_asset_lists.cs
I added * to the nt_host list with tquery above and still not working. Any ideas why?

0 Karma

Bentash
Explorer

Actually i had to wait for a while. Its working. thanks

0 Karma

Bentash
Explorer

|inputlookup pci_asset_lists.csv | eval nt_host=nt_host."*" | outputlookup pci_asset_lists.csv

sorry mistake in previous query

0 Karma

nickhills
Ultra Champion

You need to use the lookup definition. You can not use a CSV file directly for a wildcard search.

Test it works like this:

<your search> |lookup test_pci_asset nt_host as host OUTPUTNEW bunit category city ip owner
If my comment helps, please give it a thumbs up!
0 Karma

nickhills
Ultra Champion

also - check the lookup is as you expect:
|inputlookup test_pci_asset do the hotsnames include *

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...