For efficiency reasons, WILDCARD(searched_for) only supports wildcard after some initial fixed characters, like splunk*, spl*nk, etc.  If you have a table  keyword classification splunk* test classification spl*nk test classification 2 with WILDCARD(keyword) in lookup definition and test the following keyword splunk splonk splunky splash wonk splunkie splunked splonking You'll get these: searched_for classification splunk test classification test classification 2 splonk test classification 2 splunky test classification splash wonk test classification 2 splunkie test classification splunked test classification splonking   Here is the emulation for the above   | makeresults | eval searched_for = mvappend("splunk", "splonk", "splunky", "splash wonk", "splunkie", "splunked", "splonking") | mvexpand searched_for | lookup keywords.csv keyword AS searched_for OUTPUT classification | table searched_for classification   Hope this helps. ... View more