Splunk Search

inputlookup format to insert wildcard * is it possible?

r999
Path Finder

inputlookup like:

user       mailbox
smithj     john smith
bloggsj    joe bloggs

search string:

| inputlookup usermailbox.csv | fields search user mailbox | format "(" "(" "AND" ")" "OR" ")"]

returns

( ( user="smithj" AND mailbox="john smith" ) OR ( user="bloggsj" AND mailbox="joe bloggs") OR...

what i want is to return

( ( user="*smithj*" AND mailbox="*john smith*" ) OR ( user="*bloggsj*" AND mailbox="*joe bloggs*") OR...

Current workaround is to put the wildcards * in the csv values like so but this is a pain

user       mailbox
*smithj*   *john smith*
*bloggsj*  *joe bloggs*

Drainy
Champion

You could use eval to add them in manually at search time;

| eval user="*".user."*"

0 Karma

the_wolverine
Champion

No, unfortunately that doesn't work.

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...