Wildcard Assets in Asset Lookup

[ebs]

Hi,

We have several assets that have the same ending (e.g. splunkcloud.com) but the beginning changes, are we able to wildcard assets in the ES asset lookup table to something like *splunkcloud.com?

[lkutch_splunk · Accepted solution]

What's the end result that you want to achieve? I think there are different things you could do, but I'm not sure if they apply to your situation:

https://docs.splunk.com/Documentation/ES/6.4.1/Admin/Manageinternallookups

https://docs.splunk.com/Documentation/ES/6.4.1/Admin/Entityzones 

Let me know if that helps. 

[ebs]

First one helped, thanks!