Is it possible to match partial results against a lookup table?

[jambajuice]

Assume I have an event with the following field:

Name="Microsoft Office Outlook MUI (English) 2007"

Assume I have a lookup table as follows:

Vendor,Product,Version Microsoft Corporation,Outlook,2007 SP1

If the Name field does not consistently adhere to the format of the lookup table, is it possible to do a lookup that would do a partial match against the fields of the lookup table? So if the Name field contains Microsoft, Outlook, and 2007 it would match?

Thx.

Craig

[lguinn2]

Yes, it is possible now! There is a great answer given by Jason to this question:

How are values in lookups matched?

[chris]

Right now this is not possible out of the box with csv files. The match must be exact.

Have a look at:
http://answers.splunk.com/questions/718/how-are-values-in-lookups-matched
http://answers.splunk.com/questions/5916/using-cidr-in-a-lookup-table

You can write your own lookup script that will do the correct less sensitive matching:
http://www.splunk.com/base/Documentation/4.1.6/Knowledge/Addfieldsfromexternaldatasources

[hazekamp]

Be sure to use the LOOKUP- property! Does anyone know if the "lookup" search command is case sensitive/insensitive by default?

[gkanapathy]

it's possible to make the match case-insensitive, but that's currently all. other than that, the match must be exact, not partial.