Splunk Search

How to add columns from a lookup table to my search?

kcchu01
Explorer

I have a lookup table sample_lookup.csv which consists of two fields, wildcard and location

wildcard    location
   *123*        ABC
   *456*        DEF

I would like to add the location field to the existing search and create a new table so I can finally count the number of entries in each location.
My existing search is as follows.

Sample1    UserID 
212389        AAA
345699        BBB
412366        CCC
545688        DDD

I would like to have the table like this by matching the wildcard in the lookup table and add a location field in the new table:

Sample1    UserID    Location
212389        AAA        ABC
345699        BBB        DEF
412366        CCC        ABC
545688        DDD        DEF

How can I make use of lookup to achieve this? It really stuck me for a long time =(

0 Karma

woodcock
Esteemed Legend

Another option is described here (but you should go with the other one proposed):

https://answers.splunk.com/answers/386488/regex-in-lookuptable.html#answer-387536

0 Karma

sundareshr
Legend

In your lookup table add wildcard chars to your "wildcard" column, like this *123* OR *456*. Then in your transforms, under the stanza for the lookup, add

 match_type = WILDCARD(wildcard) 

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Transformsconf

Get Updates on the Splunk Community!

Monitoring MariaDB and MySQL

In a previous post, we explored monitoring PostgreSQL and general best practices around which metrics to ...

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...