Splunk Search

Does csv file accepts * symbol for lookup?

mikeyty07
Communicator

I have apis which has params in between and trying to  match the api from csv but it doesnt show when using lookup.

eg : /serviceName/api/127364/api   which is shown in access logs 
i have /serviceName/api/*/api in my csv file. 

Any idea how this works?

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You have to create a lookup definition with WILDCARD matching

Define a CSV lookup in Splunk Web - Splunk Documentation

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...