Set wildcard lookup match without access to transforms.conf

[bruceclarke]

Hey all,

I'm wondering if there is a way to set wildcard matches without needing access to transforms.conf. Here is my use case:

I have a lookup table that looks something like:

testName        email
myTeamTest-*    myTeam@...

In transforms.conf I have the following stanza:

[team_test_lookup]
filename = team_tests.csv
case_sensitive_match=false
match_type=WILDCARD(testName)

A lot of my co-workers don't have access to transforms.conf, but want to make similar lookups. Is there a way for them to do this using the Splunk front end?

[mylesfast]

You can add wildcards inside the actual lookup file fields. This method require each entry to have the properly formated wildcard.

test == endswith
test == startswith
test ==contain test

ex:
myTeamTest-

[shabdadev]

Can you please elaborate this with sample example

[masonmorales · Accepted solution]

No, configuring wildcard matching on a lookup does not exist as a setting anywhere in Splunk Web. If you have a Splunk Support contract, login to the Splunk.com Support Portal and you can submit this as an enhancement request.

[bruceclarke]

Thanks for the quick response. I thought this might be the case and was planning to do exactly that. Thanks!