Splunk Search

reverse wildcard lookup from event field in index


Hello Everyone

I am trying to see if i can pass an event field over to a lookup attached with a wildcard (reverse lookup from event filed) ? For this an example I will use the items below

table = user_table.csv
lookup = user_table_loookup

user_table.csv data below:
email, manager_name
user1@domain_1.com, "Doe, John"

I have an event field within an index of . I then have a lookup table (.csv) that contains a column email and manager_name* within the user_table_loookup.

Is it possible to attach a wildcard to the username filed and send it against the lookup table to match the username portion of the email and return the manager_name from the lookup?

index=index_1 username=user1 | lookup user_table_loookup email AS username OUTPUT manager_name

username >> email
user1 >>>> user1@domain_1.com

0 Karma