change lookup macth_type

[jonthanze]

Hi

I have a list of words in a lookup table and i would like to return the events of a search that match any of the values in the lookup.

So far, nothing really hard to implement in Splunk.

The problem is that some of the values in the lookup are partially to the one in the search
(e.g :the value in my lookup is foo and the one in my search is foobar).


I read this :

http://answers.splunk.com/answers/718/how-are-values-in-lookups-matched

and tried that :

(from transforms.conf)

[sourcetype i am querying]

filename = "lookup table file name"

case_sensitive_match = false

match_type = WILDCARD(field that contains "foobar")

But the entry "foo*" in my lookup did not find it.

Can someone please help me solving this ?

Thanks

[Ayn]

With WILDCARD you need to actually put in wildcards in your lookup in order for Splunk to do a wildcard match. So if you want to match the value "foobar" from your results, the value "foo" in the lookup will not match but "foo*" will.

[jonthanze]

Hi

as you can read under in my question , i already altered my lookup to contain the wildcards
but it doesn't work
is there a problem with the definitions in transforms.conf ?