Splunk Search

reverse wildcard lookup from event field in index

luck123813
Explorer

Hello Everyone

I am trying to see if i can pass an event field over to a lookup attached with a wildcard (reverse lookup from event filed) ? For this an example I will use the items below

table = user_table.csv
lookup = user_table_loookup

user_table.csv data below:
email, manager_name
user1@domain_1.com, "Doe, John"

I have an event field within an index of . I then have a lookup table (.csv) that contains a column email and manager_name* within the user_table_loookup.

Is it possible to attach a wildcard to the username filed and send it against the lookup table to match the username portion of the email and return the manager_name from the lookup?

index=index_1 username=user1 | lookup user_table_loookup email AS username OUTPUT manager_name

username >> email
user1 >>>> user1@domain_1.com

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...