Splunk Search

inputlookup format to insert wildcard * is it possible?

r999
Path Finder

inputlookup like:

user       mailbox
smithj     john smith
bloggsj    joe bloggs

search string:

| inputlookup usermailbox.csv | fields search user mailbox | format "(" "(" "AND" ")" "OR" ")"]

returns

( ( user="smithj" AND mailbox="john smith" ) OR ( user="bloggsj" AND mailbox="joe bloggs") OR...

what i want is to return

( ( user="*smithj*" AND mailbox="*john smith*" ) OR ( user="*bloggsj*" AND mailbox="*joe bloggs*") OR...

Current workaround is to put the wildcards * in the csv values like so but this is a pain

user       mailbox
*smithj*   *john smith*
*bloggsj*  *joe bloggs*

Drainy
Champion

You could use eval to add them in manually at search time;

| eval user="*".user."*"

0 Karma

the_wolverine
Champion

No, unfortunately that doesn't work.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...