use wildcard in lookup

[katalinali]

I have a lookup table like:

input output

========================================

KH00IS23 ABC

. . .

KH00IS98 ABC

ER97IT00 ZXC

. . .

ER97IT45 ZXC

ER97IT55_1432 ZXC03

. . .

ER97IT55_4988 ZXC03

ER97IT60_3421 UYT

. . .

ER97IT60_8764 UYT

I have several thousand of inputs but it just matches to about fifty output and the overhead of extracting all the fields is very high. I would like to ask if splunk can support wildcard or regex in lookup to the performance. By the way, is there default lookup like case i.e. if all value in a field is not match any record, then it should match to the default value.

[dvb]

There actually is the possibility of using wildcards in lookups. See answer 28566

[tawollen]

Here is something else that might work.

• | lookup mytable.csv input | eval output if(isnull(output),"default value", output)

This looks up a field in the lookup, if the field is not there, then it will put output as "default value"

[ziegfried]

No, Splunk doesn't support wildcards or regular expressions in lookups. But you can specify a default value if none of the lookup values matches. You can do so by specifing min_matches=1 and default_match=TEXT either in the stanza in transforms.conf or in the manager in the Advanced Options of the lookup.

[gkanapathy]

This answer was correct, but is out of date as of version 4.2