I have a list of words in a lookup table and i would like to return the events of a search that match any of the values in the lookup.
So far, nothing really hard to implement in Splunk.
The problem is that some of the values in the lookup are partially to the one in the search (e.g :the value in my lookup is foo and the one in my search is foobar).
I read this :
and tried that :
[sourcetype i am querying]
filename = "lookup table file name"
case_sensitive_match = false
match_type = WILDCARD(field that contains "foobar")
With WILDCARD you need to actually put in wildcards in your lookup in order for Splunk to do a wildcard match. So if you want to match the value "foobar" from your results, the value "foo" in the lookup will not match but "foo*" will.
as you can read under in my question , i already altered my lookup to contain the wildcards
but it doesn't work
is there a problem with the definitions in transforms.conf ?