Splunk Search

Transforms.conf and wildcard mask

rbw78
Communicator

Hi guys,

I'm using a lookup file matching on decades values field.
My goal is to make a chart with 5 columns, 4 with the main values and 1 with all the others aggregated together.

Here's the lookup file

N_vendor,vendor
java,java
adobe,adobe
microsoft,microsoft
mozilla,mozilla
*,Others

Here's the transforms.conf

[vendor_bis]
filename = vendor_bis.csv
min_matches = 1
default_match = Others
case_sensitive_match = false
match_type = WILDCARD(N_vendor)

The 4 first columns in my lookup file appears on the chart but not the last using a wildcard to make match the rest as "Others".
Did i'm missing something ?

Thanks.

0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

I wonder if the default match should not the be "*" ?

if this doesn't' work, you always can can use the fillnull command in the search

< mysearch > | < mylookup > | fillnull vendor value="Others" | stats count by vendor

View solution in original post

yannK
Splunk Employee
Splunk Employee

I wonder if the default match should not the be "*" ?

if this doesn't' work, you always can can use the fillnull command in the search

< mysearch > | < mylookup > | fillnull vendor value="Others" | stats count by vendor

yannK
Splunk Employee
Splunk Employee

Remark, if the field "N_vendor" do not exists in the original events, then the lookup will never return any values, and you have to use the "fillnull method"

If the field N_vendor exists, then you can use this type of default lookup result.

  • lookup file using "default" or any value instead of "*"

N_vendor,vendor
java,java
adobe,adobe
microsoft,microsoft
mozilla,mozilla
default,Others

- transforms.conf with

[vendor_bis]
filename = vendor_bis.csv
min_matches = 1
default_match = default
case_sensitive_match = false
match_type = WILDCARD(N_vendor)

0 Karma

rbw78
Communicator

Well the fillnul function worked, not the transforms.conf modification.

Thanks for help yannK !

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...