Splunk Search

How to create an automatic lookup where lookup input fields are similar to the CSV fields?

dwalker1
New Member

HI Folks,

I'm trying to get automatic lookups working for a custom CSV file import. I'm trying to key in on two fields that have similar host names, but not exact. Is there a way to use something like contains versus equals?

Examples:

CSV Lookup Field: WAN_device_dns

Splunk Field: Host

CSV Lookup Field value: washington_bah.domain.com

Splunk Fields value: washington_bah-loop7

I'd like to equate these fields as the same in the automatic field association if the beginning matches since my CSV script automatically generates externally. If not, I'll have to rewrite the CSV output.

Thanks all,
G1

0 Karma
1 Solution

MuS
Legend

Hi dwalker1,

you can have a look at the match_type option in transforms.conf http://docs.splunk.com/Documentation/Splunk/latest/Admin/Transformsconf which supports wildcard matches. See this answers https://answers.splunk.com/answers/52580/can-we-use-wildcard-characters-in-a-lookup-table.html for a good example.

If this does not work for you, you could use eval and the match or like http://docs.splunk.com/Documentation/Splunk/6.4.0/SearchReference/CommonEvalFunctions#Comparison_and... functions to normalise or compare the fields.

Hope this helps ...

cheers, MuS

View solution in original post

0 Karma

MuS
Legend

Hi dwalker1,

you can have a look at the match_type option in transforms.conf http://docs.splunk.com/Documentation/Splunk/latest/Admin/Transformsconf which supports wildcard matches. See this answers https://answers.splunk.com/answers/52580/can-we-use-wildcard-characters-in-a-lookup-table.html for a good example.

If this does not work for you, you could use eval and the match or like http://docs.splunk.com/Documentation/Splunk/6.4.0/SearchReference/CommonEvalFunctions#Comparison_and... functions to normalise or compare the fields.

Hope this helps ...

cheers, MuS

0 Karma

dwalker1
New Member

Thanks for the quick response. I'll have to dig further but it looks like what I'm looking for. Thanks again!

G1

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...