Splunk Search

Set wildcard lookup match without access to transforms.conf

bruceclarke
Contributor

Hey all,

I'm wondering if there is a way to set wildcard matches without needing access to transforms.conf. Here is my use case:

I have a lookup table that looks something like:

testName        email
myTeamTest-*    myTeam@...

In transforms.conf I have the following stanza:

[team_test_lookup]
filename = team_tests.csv
case_sensitive_match=false
match_type=WILDCARD(testName)

A lot of my co-workers don't have access to transforms.conf, but want to make similar lookups. Is there a way for them to do this using the Splunk front end?

1 Solution

masonmorales
Influencer

No, configuring wildcard matching on a lookup does not exist as a setting anywhere in Splunk Web. If you have a Splunk Support contract, login to the Splunk.com Support Portal and you can submit this as an enhancement request.

View solution in original post

mylesfast
Engager

You can add wildcards inside the actual lookup file fields. This method require each entry to have the properly formated wildcard.

test == endswith
test
== startswith
test ==contain test

ex:
myTeamTest-

0 Karma

shabdadev
Engager

Can you please elaborate this with sample example

0 Karma

masonmorales
Influencer

No, configuring wildcard matching on a lookup does not exist as a setting anywhere in Splunk Web. If you have a Splunk Support contract, login to the Splunk.com Support Portal and you can submit this as an enhancement request.

bruceclarke
Contributor

Thanks for the quick response. I thought this might be the case and was planning to do exactly that. Thanks!

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...