Splunk Search

Can you help me with my wildcard search in a lookup?

New Member

Hi ,

I have created a csv lookup and wanted to perform wild card search on it. Is it possible?
lookup name # Inputlookup value.csv

Can anyone please suggest me on it.

Thanks in advance.

0 Karma


It can not be set in GUI when wild card is used. You need to edit the configuration file.


0 Karma



can you provide a little bit more context? How do you want to search on the lookup? Do you have a search example?

You can always use
| inputlookup value.csv | search foo=*

or you can use the where clause directly in the inputlookup command, which is better for performance:
| inputlookup value.csv where foo > 0

You can find more examples in the inputlookup documentation:



0 Karma

New Member

Thank you for your reply.
I wanted to use in the below way. I dont want to specify the column name
inputlookup value.csv| search "wildcharater"

0 Karma


You can not search in the lookup file without specifying a field. A lookup does not run through the indexing pipeline and therefore isnt tokenized and does not have a_raw field for example, therefore you can not search just for text.

But if your csv file has timestamps, you can of course just index your csv file, like you would index any other data.

0 Karma
Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...