Splunk Search

lookup table using like syntax

rdownie
Communicator

If I have a lookup table that contains the following:


mstring,category
%-mdfa,network
%-mdfb,network
%cam,camera
%-avaya,phone

and I want to match it using a like syntax (SQL or where hostname like mstring) where I could have b01k-mdfa return network for category. Is there a way to do this with a lookup?

Tags (2)
0 Karma
1 Solution

Ayn
Legend

Not using % as wildcard, but *. When you define your lookup table in transforms.conf, you can specify a MATCH_TYPE. Set this to WILDCARD and you will be able to lookup values using a table similar to yours. Something like

mstring,category
*-mdfa,network
...

http://docs.splunk.com/Documentation/Splunk/latest/admin/Transformsconf

View solution in original post

Ayn
Legend

Not using % as wildcard, but *. When you define your lookup table in transforms.conf, you can specify a MATCH_TYPE. Set this to WILDCARD and you will be able to lookup values using a table similar to yours. Something like

mstring,category
*-mdfa,network
...

http://docs.splunk.com/Documentation/Splunk/latest/admin/Transformsconf

View solution in original post

rdownie
Communicator

Thanks, worked like a charm!!!!

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.