Splunk Search

Why does putting in a wildcard for Sourcetype in the "Apply to" menu not work when adding a new automatic lookup?

newbiesplunk
Path Finder

Hi,

When I add a new automatic lookup, if I put * at the Apply to: Sourcetype, it does not work, but if i put the specific sourcetype, it works. Does it mean that i need to create a lot of automatic lookups for the same lookup table?

thks

0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

Because the wildcards are not supported for sourcetypes in props.conf.

Only for source or host.

View solution in original post

yannK
Splunk Employee
Splunk Employee

Because the wildcards are not supported for sourcetypes in props.conf.

Only for source or host.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...