About splunkuser924

splunkuser924 · ‎08-18-2022

I've started to solve my own problem but I have hit a snag... It turns out that I was doing the right thing by setting the lookup definition to WILDCARD(Words) but I wasn't calling the lookup definition, still just the lookup table, oops... I'm using the following and it's kinda working. I had to modify my list of words as such Words *word1* *word2* my search terms | lookup "My Lookup" Words as Interesting OUTPUT Words | table _time, user, Interesting, Words Now I get matches, but too many matches. _time user Interesting Words 8/18/2022 user1 my words1list here words1 The above match is incorrect as I only want full word matches. I tried updating my lookup table to * words1 * (note the space) and that works for "my words1 here" but not "I have words1".

splunkuser924 · ‎08-18-2022

I'm trying to do a search with a lookup table and can't seem to get the search to perform what I'm wanting. I have some data that produces a table output like below. _time user interesting 8/18/22 user1 a few words here I have a lookup table with a list of words in it. The lookup table has a header of "Words" and a list of words separated by line feed. I would like to perform a search where I get back the sub results of the main search where a single word in my lookup matches anywhere in the interesting field. I got a partial match with the following search. my search terms | lookup WordsLookup.csv Words as Interesting OUTPUT Words | table _time, user, Interesting, Words In this case, it will return all results for my search terms and only a match where the Interesting field is EXACTLY the lookup of Words. I set WILDCARD(Words) in the lookup definition. Help? Thanks

Posts	2
Solutions	0
Karma Given	0
Karma Received	1
Member Since	‎08-18-2022

Online Status	Offline
Date Last Visited	‎08-23-2022 04:13 PM

How to lookup table wildcard search?

Re: How to lookup table wildcard search?

How to lookup table wildcard search?