Splunk Search

splunk lookup like match

VARWIZ
New Member

i have a lookup csv with say 2 columns

colA colB
sb12121 800
sb879898 1000
ax61565 680
ax7688 909

I need to perform a lookup search that matches like colA which may result in

sb12121 800
sb879898 1000

if one of the columns in the logs start with sb (note that it may not be an abs match)

I can write a query that absolutely matches with a field in column but I am not sure how to perform a like match. I read something about transforms.conf but not sure where and how to use it. all im trying to do is perform a simple search command, that can do this lookupfor me. do i really need the tranforms.conf file for this ? cant we not do a wildcard search directly in the query ?

Tags (3)
0 Karma

VARWIZ
New Member

test.csv
item item_name item_type
1 google url
1 facebook url
1 intel url
1 apple url
1 espn url

index=proxylog| lookup test.csv item_name AS uri OUTPUT item_type | search item_type=*

this is not giving me any matches even though there are multiple google/facebook/intel matching uris in splunk events..

any idea why ?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...