I'm wondering if there is a way to set wildcard matches without needing access to transforms.conf. Here is my use case:
I have a lookup table that looks something like:
testName email myTeamTest-* myTeam@...
In transforms.conf I have the following stanza:
[team_test_lookup] filename = team_tests.csv case_sensitive_match=false match_type=WILDCARD(testName)
A lot of my co-workers don't have access to transforms.conf, but want to make similar lookups. Is there a way for them to do this using the Splunk front end?
No, configuring wildcard matching on a lookup does not exist as a setting anywhere in Splunk Web. If you have a Splunk Support contract, login to the Splunk.com Support Portal and you can submit this as an enhancement request.
Thanks for the quick response. I thought this might be the case and was planning to do exactly that. Thanks!
You can add wildcards inside the actual lookup file fields. This method require each entry to have the properly formated wildcard.
test == endswith
test == startswith
test ==contain test