Splunk Search

change lookup macth_type

jonthanze
Explorer

Hi

I have a list of words in a lookup table and i would like to return the events of a search that match any of the values in the lookup.

So far, nothing really hard to implement in Splunk.

The problem is that some of the values in the lookup are partially to the one in the search
(e.g :the value in my lookup is foo and the one in my search is foobar).


I read this :

http://answers.splunk.com/answers/718/how-are-values-in-lookups-matched

and tried that :

(from transforms.conf)


[sourcetype i am querying]
filename = "lookup table file name"
case_sensitive_match = false
match_type = WILDCARD(field that contains "foobar")



But the entry "foo*" in my lookup did not find it.

Can someone please help me solving this ?

Thanks

0 Karma

Ayn
Legend

With WILDCARD you need to actually put in wildcards in your lookup in order for Splunk to do a wildcard match. So if you want to match the value "foobar" from your results, the value "foo" in the lookup will not match but "foo*" will.

0 Karma

jonthanze
Explorer

Hi

as you can read under in my question , i already altered my lookup to contain the wildcards
but it doesn't work
is there a problem with the definitions in transforms.conf ?

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...