Splunk Search

Can I use wildcards in the lookup csv file to show a list of similar named servers?

martinjnancy
New Member

I'm using a lookup table to further define the type of servers listed in a drop down box. The csv file is manually created, so I would like to use wildcards to specify my search criteria.

From:
hostname,landscape,servertype,org
us6pb1d01,"SAP BW (PB1)",db,ccr_nmon
us6pb1a01,"SAP BW (PB1)",app,ccr_nmon
us6pb1a02,"SAP BW (PB1)",app,ccr_nmon
us6pwmd01,"WebMethods (PWM)",db,ccr_nmon
us6pwmd02,"WebMethods (PWM)",db,ccr_nmon

To:
hostname,landscape,servertype,org
us6pb1d*,"SAP BW (PB1)",db,ccr_nmon
us6pb1a*,"SAP BW (PB1)",app,ccr_nmon
us6pwmd*,"WebMethods (PWM)",db,ccr_nmon

I have the following in my transforms.conf file:

[nmon_serverlookup]
filename = ccr_serverlookup.csv
match_type = WILDCARD(servertype)

However, when I go to select a server, it is listing "us6pwmd*" and not giving a list of servers.

Here are parts of my input criteria:

  <populatingSearch earliest="$timerange.earliest$" latest="$timerange.latest$" fieldForLabel="landscape" fieldForValue="landscape">| inputlookup ccr_serverlookup.csv | fields landscape | dedup landscape | table landscape</populatingSearch>
<input type="dropdown" token="servertype" searchWhenChanged="true">
  <label>Server Type:</label>
  <default>All</default>
  <choice value="*">All</choice>
  <choice value="app">Application</choice>
  <choice value="db">Database</choice>
</input>
<input type="multiselect" token="hostname" searchWhenChanged="true">
  <label>Hosts Selection:</label>
  <populatingSearch earliest="$timerange.earliest$" latest="$timerange.latest$" fieldForLabel="hostname" fieldForValue="hostname">|inputlookup ccr_serverlookup.csv | where landscape="$landscape$" AND servertype="$servertype$" | stats count by hostname | dedup hostname | sort hostname

Any suggestions??

Many thanks!

Tags (2)
0 Karma

vasanthmss
Motivator

is it working?

V
0 Karma

vasanthmss
Motivator

Add * front and back of your token based on your req like server type

inputlookup ccr_serverlookup.csv | where landscape="$landscape$" AND servertype="*$servertype$*" | stats count by hostname | dedup hostname | sort hostname
V
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...