We have several assets that have the same ending (e.g. splunkcloud.com) but the beginning changes, are we able to wildcard assets in the ES asset lookup table to something like *splunkcloud.com?
What's the end result that you want to achieve? I think there are different things you could do, but I'm not sure if they apply to your situation:https://docs.splunk.com/Documentation/ES/6.4.1/Admin/Manageinternallookups
Let me know if that helps.
View solution in original post
First one helped, thanks!