Use Wildcards, 'contains' or 'like' on lookup table - Splunk Cloud

[JordanR]

If I have a lookup table that contains the following:

error,priority

Unable to find any company of ID,P2

500 Internal Server Error,P1

 And result query with fields:

• 500 Internal Server Error: {xxx}
• Unable to find any company of ID: xxx

Using the below query only brings back direct matches:

<search query>
| lookup _error_message_prority error AS ErrorMessage OUTPUTNEW Priority AS Priority

Is there a way to use wildcards, 'like' or 'contains' when using lookup tables in Splunk Cloud?

[richgalloway]

Yes, lookups can support wildcards.  Go to Settings->Lookups->Lookup definitions and edit the lookup.  Tick the "Advanced options" box and enter WILDCARD(error) in the "Match type" box.  Then it's up to the lookup file to have wildcards in the appropriate places.