using wild card in a lookup column?

[pavanae]

I have a lookup sample.csv as follows whereas one of the host value is empty 

Name	Host
TEST_USER	abc, def
USER_1	*
user_3	ghi

Now I use the lookup in a search. Now for the USER_1 Host I want to use the wild card. Using astrick symbol directly in the lookup doesn't working. Is there any way I can add a wild card for USER_1. 

A little research on the Splunk docs gives me some inputs like I need to use props and transforms to do so. I don't have a props or transforms exists for that application. Can I create a condition in props, transforms just for the above purpose. If so what should be the stanzas should be in both the configuration files. 

Any Help would be great. 

[somesoni2]

If you're trying to do wildcard match when you do a lookup (running "| lookup" command), then you can follow this to setup wildcard match:

https://community.splunk.com/t5/Splunk-Search/Can-we-use-wildcard-characters-in-a-lookup-table/m-p/9...

If not, then you should add more details like how you're using the lookup, what output you get now and what is want to see as the output.

[nmohammed]

@pavanae 

can you share your search query ? But you should be able to search the host like following - 

| inputlookup answers-571895.csv
| where Host="*"