Hello @sparachi,
you can use KVstore instead of local lookups, here is a comparison between them:
https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/DefineaKVStorelookupinSplunkWeb
... View more
Thanks for your response .. your solution works part of my requirement but we are not sure that in only first 4 characters we find the pattern .. string may also be of 22na9INDI, USAABCD, 123INDIBritain..like that ..
... View more