Please any help will be appreciated.
We have a lookup test_pci_asset.csv with a field nt_host
values of nt_host are host1 host2
Raw log in splunk host fields are host1.abc.com
We are trying to use automatic lookup to match the host field so when we run a query it can pull back host1.abc.com as host.
We tried the following with WILDCARD(nt_host) but no luck. Props and transforms below
props.conf
[default]
LOOKUP-test_pci_asset.csv = test_pci_asset nt_host AS host OUTPUTNEW bunit category city ip owner
transforms.conf
[test_pci_asset]
batch_index_query = 0
case_sensitive_match = 0
filename = test_pci_asset.csv
match_type = WILDCARD(nt_host)
