lookup table using like syntax

[rdownie]

If I have a lookup table that contains the following:

mstring,category

%-mdfa,network

%-mdfb,network

%cam,camera

%-avaya,phone

and I want to match it using a like syntax (SQL or where hostname like mstring) where I could have b01k-mdfa return network for category. Is there a way to do this with a lookup?

[Ayn · Accepted solution]

Not using % as wildcard, but *. When you define your lookup table in transforms.conf, you can specify a MATCH_TYPE. Set this to WILDCARD and you will be able to lookup values using a table similar to yours. Something like

mstring,category
*-mdfa,network
...

http://docs.splunk.com/Documentation/Splunk/latest/admin/Transformsconf

[rdownie]

Thanks, worked like a charm!!!!