Assume I have an event with the following field:
Name="Microsoft Office Outlook MUI (English) 2007"
Assume I have a lookup table as follows:
Vendor,Product,Version Microsoft Corporation,Outlook,2007 SP1
If the Name field does not consistently adhere to the format of the lookup table, is it possible to do a lookup that would do a partial match against the fields of the lookup table? So if the Name field contains Microsoft, Outlook, and 2007 it would match?
Thx.
Craig
Yes, it is possible now! There is a great answer given by Jason to this question:
Right now this is not possible out of the box with csv files. The match must be exact.
Have a look at:
http://answers.splunk.com/questions/718/how-are-values-in-lookups-matched
http://answers.splunk.com/questions/5916/using-cidr-in-a-lookup-table
You can write your own lookup script that will do the correct less sensitive matching:
http://www.splunk.com/base/Documentation/4.1.6/Knowledge/Addfieldsfromexternaldatasources
Be sure to use the LOOKUP- property! Does anyone know if the "lookup" search command is case sensitive/insensitive by default?
it's possible to make the match case-insensitive, but that's currently all. other than that, the match must be exact, not partial.