Splunk Search

Lookup command can take wildcard(*) as an input.

vranjith009
New Member

Suppose i have a lookup with two fields input and output.

Initial,Final
abc*,abc
def*,def

so anything matches with abc* should give abc as output. Similarly anything matches with def* should give def as output.

Added csv file in lookups file of particular app.
Created transforms.conf in local folder and added below lines.
[abc]
filename = abc.csv

I m not getting anything with the below query.

index=* sourcetype=* | lookup abc Initial OUTPUT Final

Thanks in advance

Tags (1)
0 Karma

vranjith009
New Member

Thanks Michaelis... got the answer

0 Karma

JMichaelis
Path Finder
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...