Splunk Search

change lookup macth_type

Explorer

Hi

I have a list of words in a lookup table and i would like to return the events of a search that match any of the values in the lookup.

So far, nothing really hard to implement in Splunk.

The problem is that some of the values in the lookup are partially to the one in the search
(e.g :the value in my lookup is foo and the one in my search is foobar).


I read this :

http://answers.splunk.com/answers/718/how-are-values-in-lookups-matched

and tried that :

(from transforms.conf)


[sourcetype i am querying]
filename = "lookup table file name"
case_sensitive_match = false
match_type = WILDCARD(field that contains "foobar")



But the entry "foo*" in my lookup did not find it.

Can someone please help me solving this ?

Thanks

0 Karma

Legend

With WILDCARD you need to actually put in wildcards in your lookup in order for Splunk to do a wildcard match. So if you want to match the value "foobar" from your results, the value "foo" in the lookup will not match but "foo*" will.

0 Karma

Explorer

Hi

as you can read under in my question , i already altered my lookup to contain the wildcards
but it doesn't work
is there a problem with the definitions in transforms.conf ?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!