Splunk Search
Highlighted

Set wildcard lookup match without access to transforms.conf

Contributor

Hey all,

I'm wondering if there is a way to set wildcard matches without needing access to transforms.conf. Here is my use case:

I have a lookup table that looks something like:

testName        email
myTeamTest-*    myTeam@...

In transforms.conf I have the following stanza:

[team_test_lookup]
filename = team_tests.csv
case_sensitive_match=false
match_type=WILDCARD(testName)

A lot of my co-workers don't have access to transforms.conf, but want to make similar lookups. Is there a way for them to do this using the Splunk front end?

Highlighted

Re: Set wildcard lookup match without access to transforms.conf

Influencer

No, configuring wildcard matching on a lookup does not exist as a setting anywhere in Splunk Web. If you have a Splunk Support contract, login to the Splunk.com Support Portal and you can submit this as an enhancement request.

View solution in original post

Highlighted

Re: Set wildcard lookup match without access to transforms.conf

Contributor

Thanks for the quick response. I thought this might be the case and was planning to do exactly that. Thanks!

0 Karma
Highlighted

Re: Set wildcard lookup match without access to transforms.conf

Engager

You can add wildcards inside the actual lookup file fields. This method require each entry to have the properly formated wildcard.

test == endswith
test
== startswith
test ==contain test

ex:
myTeamTest-

0 Karma
Highlighted

Re: Set wildcard lookup match without access to transforms.conf

Engager

Can you please elaborate this with sample example

0 Karma