I recently noticed that the UI for lookup definitions now has an advanced checkbox. If I select that I get the option to set match_type , which is described as
Match type
Optionally set up non-exact matching of a comma-and-space-delimited field list. Format is (). Available values for match_type are WILDCARD and CIDR.
so I added a wildard match for my lookup field IP to my lookup definition for tools :
match_type=WILDCARD (IP)
(note, I tried CIDR , too, with similar results)
and in the lookup file tools.csv , I had an entry with a *
IP: 10.10.35.*
Tool: Splunk
but when try to use it, I do not get a match:
|makeresults |eval IP="10.10.35.9" | lookup tools IP
This did not return the Tool field, although if I pass it a matching string it does:
|makeresults |eval IP="10.10.35.*" | lookup tools IP
gets me back tool = Splunk
is there something that I am misunderstanding about the UI based lookup wildcard? Something else that I should be doing?
... View more