Splunk Search

How to add columns from a lookup table to my search?

kcchu01
Explorer

I have a lookup table sample_lookup.csv which consists of two fields, wildcard and location

wildcard    location
   *123*        ABC
   *456*        DEF

I would like to add the location field to the existing search and create a new table so I can finally count the number of entries in each location.
My existing search is as follows.

Sample1    UserID 
212389        AAA
345699        BBB
412366        CCC
545688        DDD

I would like to have the table like this by matching the wildcard in the lookup table and add a location field in the new table:

Sample1    UserID    Location
212389        AAA        ABC
345699        BBB        DEF
412366        CCC        ABC
545688        DDD        DEF

How can I make use of lookup to achieve this? It really stuck me for a long time =(

0 Karma

woodcock
Esteemed Legend

Another option is described here (but you should go with the other one proposed):

https://answers.splunk.com/answers/386488/regex-in-lookuptable.html#answer-387536

0 Karma

sundareshr
Legend

In your lookup table add wildcard chars to your "wildcard" column, like this *123* OR *456*. Then in your transforms, under the stanza for the lookup, add

 match_type = WILDCARD(wildcard) 

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Transformsconf

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...