Knowledge Management

using wild card in a lookup column?


I have a lookup sample.csv as follows whereas one of the host value is empty 


Name Host
TEST_USERabc, def


Now I use the lookup in a search. Now for the USER_1 Host I want to use the wild card. Using astrick symbol directly in the lookup doesn't working. Is there any way I can add a wild card for USER_1. 

A little research on the Splunk docs gives me some inputs like I need to use props and transforms to do so. I don't have a props or transforms exists for that application. Can I create a condition in props, transforms just for the above purpose. If so what should be the stanzas should be in both the configuration files. 


Any Help would be great. 


Labels (1)
0 Karma


If you're trying to do wildcard match when you do a lookup (running "| lookup" command), then you can follow this to setup wildcard match:


If not, then you should add more details like how you're using the lookup, what output you get now and what is want to see as the output.

0 Karma



can you share your search query ? But you should be able to search the host like following - 

| inputlookup answers-571895.csv
| where Host="*"


0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...