Splunk Search

How to lookup table wildcard search?

splunkuser924
Engager

I'm trying to do a search with a lookup table and can't seem to get the search to perform what I'm wanting. I have some data that produces a table output like below.

_time user interesting
8/18/22 user1 a few words here

 

I have a lookup table with a list of words in it. The lookup table has a header of "Words" and a list of words separated by line feed. I would like to perform a search where I get back the sub results of the main search where a single word in my lookup matches anywhere in the interesting field. I got a partial match with the following search.

 

my search terms | lookup WordsLookup.csv Words as Interesting OUTPUT Words | table _time, user, Interesting, Words

 

In this case, it will return all results for my search terms and only a match where the Interesting field is EXACTLY the lookup of Words. I set WILDCARD(Words) in the lookup definition.

 

Help? Thanks

Labels (2)
0 Karma

splunkuser924
Engager

I've started to solve my own problem but I have hit a snag... It turns out that I was doing the right thing by setting the lookup definition to WILDCARD(Words) but I wasn't calling the lookup definition, still just the lookup table, oops... I'm using the following and it's kinda working. I had to modify my list of words as such

 

Words

*word1*

*word2*

 

my search terms | lookup "My Lookup" Words as Interesting OUTPUT Words | table _time, user, Interesting, Words

 

Now I get matches, but too many matches. 

 

_timeuserInterestingWords
8/18/2022user1my words1list herewords1

 

The above match is incorrect as I only want full word matches. I tried updating my lookup table to * words1 * (note the space) and that works for "my words1 here" but not "I have words1".

Get Updates on the Splunk Community!

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...