Splunk Search

Why does putting in a wildcard for Sourcetype in the "Apply to" menu not work when adding a new automatic lookup?

newbiesplunk
Path Finder

Hi,

When I add a new automatic lookup, if I put * at the Apply to: Sourcetype, it does not work, but if i put the specific sourcetype, it works. Does it mean that i need to create a lot of automatic lookups for the same lookup table?

thks

0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

Because the wildcards are not supported for sourcetypes in props.conf.

Only for source or host.

View solution in original post

yannK
Splunk Employee
Splunk Employee

Because the wildcards are not supported for sourcetypes in props.conf.

Only for source or host.

Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...