Dashboards & Visualizations

How can I search using an inputlookp with wildcards and spaces?

humanBeing
Engager

I'm trying to search for a string from a lookup table that has wildcards and spaces.  

For example, if I have a field named firewall_string_field that has the following value:

random text randomtext random My File Name With Spaces.doc random randomrandom

My lookup table named my_special_lookup.csv

Field1
"*My File Name With Spaces.doc*"
"*Second File Name With Spaces.doc*"

 

My query looks like:
index=firewall [|inputlookup my_special_lookup.csv | fields Field1 | rename Field1 AS firewall_string_field]

I get no results.  

I get results if I do a simple search like:
index=firewall firewall_string_field="*My File Name With Spaces.doc*"

I tried creating a lookup definition with matchtype WILDCARD(Field1) but am still getting no results.  

Labels (1)
0 Karma

marysan
Communicator

this must work :
index=firewall
|lookup my_special_lookup.csv  Field1 as firewall_string_field


richgalloway
SplunkTrust
SplunkTrust

When troubleshooting queries containing subsearches it helps to start with the subsearch alone and add the |format command on the end.  This will show what the subsearch is returning to the main search and (hopefully) give a clue about what should be changed to get the desired results.  In this case, simply adding the format command should do it.

index=firewall [
  | inputlookup my_special_lookup.csv 
  | fields Field1 
  | rename Field1 AS firewall_string_field 
  | format
]
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...