I have a lookup sample.csv as follows whereas one of the host value is empty
Name | Host |
TEST_USER | abc, def |
USER_1 | * |
user_3 | ghi |
Now I use the lookup in a search. Now for the USER_1 Host I want to use the wild card. Using astrick symbol directly in the lookup doesn't working. Is there any way I can add a wild card for USER_1.
A little research on the Splunk docs gives me some inputs like I need to use props and transforms to do so. I don't have a props or transforms exists for that application. Can I create a condition in props, transforms just for the above purpose. If so what should be the stanzas should be in both the configuration files.
Any Help would be great.
If you're trying to do wildcard match when you do a lookup (running "| lookup" command), then you can follow this to setup wildcard match:
If not, then you should add more details like how you're using the lookup, what output you get now and what is want to see as the output.
can you share your search query ? But you should be able to search the host like following -
| inputlookup answers-571895.csv
| where Host="*"