If I have a lookup table that contains the following:
error,priority
Unable to find any company of ID,P2
500 Internal Server Error,P1
And result query with fields:
Using the below query only brings back direct matches:
<search query>
| lookup _error_message_prority error AS ErrorMessage OUTPUTNEW Priority AS Priority
Is there a way to use wildcards, 'like' or 'contains' when using lookup tables in Splunk Cloud?
Yes, lookups can support wildcards. Go to Settings->Lookups->Lookup definitions and edit the lookup. Tick the "Advanced options" box and enter WILDCARD(error) in the "Match type" box. Then it's up to the lookup file to have wildcards in the appropriate places.