Splunk Search

Lookup command can take wildcard(*) as an input.

vranjith009
New Member

Suppose i have a lookup with two fields input and output.

Initial,Final
abc*,abc
def*,def

so anything matches with abc* should give abc as output. Similarly anything matches with def* should give def as output.

Added csv file in lookups file of particular app.
Created transforms.conf in local folder and added below lines.
[abc]
filename = abc.csv

I m not getting anything with the below query.

index=* sourcetype=* | lookup abc Initial OUTPUT Final

Thanks in advance

Tags (1)
0 Karma

vranjith009
New Member

Thanks Michaelis... got the answer

0 Karma

JMichaelis
Path Finder
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...