This was incredibly useful. Thank you! ... View more

I just ran into an issue with the accepted answer. While the $ work for a normal query. When using it in a dashboard the $123$ is evaluated as a dashboard token rather than a field. For a dashboard you must change it to single quotes.   | stats count as 123 | eval abc = round('123', 2) ... View more

@danielbarr, did you manage to get this working? I am trying to achieve the same think but without great success... ... View more

It looks like as of at least Splunk Version 7.0.3.4 if you go into Lookups -> Lookup definitions and select the "Advanced options" checkbox there's now a Match type field. I just added "WILDCARD(fieldname)" there and it worked. ... View more