Splunk Search

wildcard in lookup file

gudavasr
Path Finder

Hi,
My transform file:

 [taskname]
 REGEX = \b(Task\w+)\b
 FORMAT = taskname::$1

 props.conf
 REPORT-taskname = taskname

 lookup file:
 error, solution
 taskname, abcdef

this query works as I want:

   "Task*" "exception" | join error [ inputlookup lookupfile.csv | fields error, solution   
   |    rename apperror as taskname ] | table _time, source, taskname, solution

however: if I change transforms file like this:

 [taskname]
 REGEX = \b(Task\w+)\b
 FORMAT = taskname::$1
 match_type = WILDCARD(stname)

and in lookup file:

error, solution
taskname*, abcdef

Above query won't work. the doc says we can use wildcharacter but I am not getting what I am doing wrong. Can someone please help?

Tags (1)
0 Karma

bjoernjensen
Contributor

Did you look into this Question?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...