Splunk Search

automatic lookup - match_type = wildcard

KarunK
Contributor

Hi All,

Again depending on my favourite support people.

I have lookup file looks like below.

channel,customer
chnl-7,channel7
bbc-1,BBC
nnc-2BBC

I have a log entry containing a URL which looks like below. The URL field is highlighted.

125-11-2012 http://telstra.com/chnl-7/sports/cricket.isml 23 788000 200

I need to define a autolookup which provides a field called channel when i search for the logs.

transforms.conf

[cds_test]
filename = cds_test.csv
min_matches = 1
default_match = Others
case_sensitive_match = false
match_type = WILDCARD(channel)

props.conf is defined accordingly.

Right now with the above transforms i have to add "*" at the end of the channels info in CSV like below. This is not possible because I am creating lookup csv file is automatically using a scheduled search.

Is there any way i can do this using with out "*" ?

channel,customer
*chnl-7*,channel7
*bbc-1*,BBC
*bbc-2*,BBC

Thanks

KK

Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Looking at the URL, you could extract the channel into a field and not use any wildcard matching at all.

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Looking at the URL, you could extract the channel into a field and not use any wildcard matching at all.

0 Karma
Get Updates on the Splunk Community!

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...