Events mismatch values with lookup values

[uagraw01]

Hello Splunkers!!

We have events that contains source and destination fields with complete values, and we want to match these fields against event data where the corresponding fields (source and destination) may include wildcard values in the lookup. The goal is to accurately match the event data with the appropriate lookup values, ensuring that wildcard patterns in the lookup are properly evaluated during the matching process.

Values to be match with below lookup.

What I have tried so far to match events field values with the lookup field values. But no luck found. Please give me some suggestion to execute this correctly.

| lookup movement_type_ah mark_code as mark_code destination as destination source as source OUTPUTNEW movement_type

[gcusello · Accepted solution]

Hi @uagraw01 ,

what's the issue?

did you unflagged the checkbox for exact match in the Lookup Definition?

Ciao.

Giuseppe

[uagraw01]

@gcusello As per the below screenshot, I need to specify in the match_type for both the fields ?

FYI @gcusello  I have added below entries and it starts working as expected.

WILDCARD(source), WILDCARD(position), WILDCARD(destination)

[gcusello]

Hi @uagraw01 ,

good for you, remember to unflag the Case sensitive match.

let me know if I can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉