Knowledge Management

using wild card in a lookup column?


I have a lookup sample.csv as follows whereas one of the host value is empty 


Name Host
TEST_USERabc, def


Now I use the lookup in a search. Now for the USER_1 Host I want to use the wild card. Using astrick symbol directly in the lookup doesn't working. Is there any way I can add a wild card for USER_1. 

A little research on the Splunk docs gives me some inputs like I need to use props and transforms to do so. I don't have a props or transforms exists for that application. Can I create a condition in props, transforms just for the above purpose. If so what should be the stanzas should be in both the configuration files. 


Any Help would be great. 


Labels (1)
0 Karma

Revered Legend

If you're trying to do wildcard match when you do a lookup (running "| lookup" command), then you can follow this to setup wildcard match:


If not, then you should add more details like how you're using the lookup, what output you get now and what is want to see as the output.

0 Karma



can you share your search query ? But you should be able to search the host like following - 

| inputlookup answers-571895.csv
| where Host="*"


0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...