Splunk Search

Lookup Definition using Match Type


I am attempting to create a new "Week" field based on an external lookup.

However, the date field in my sourcetype and lookup DO NOT match. The date field in the sourcetype is in following format %d/%m/%Y %H:%M (e.g. 31/05/2018 00:05). The Date field in my lookup table is in following format %d/%m%/Y (e.g. 31/05/2018).

Can I use Match Type in lookup definition to use a wildcard on Date field in order to return "Week" field? Can't seem to get it to work.


0 Karma

Esteemed Legend

That feature does not work anything like what you need. Skip the lookup and just use something like this:

|makeresults | eval date="31/05/2018 00:05"
| eval _time = strptime(date, "%d/%m/%Y %H:%M")
| eval week=strftime(_time, "%Y-W%0W-%0w")
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!