Implementing Splunk 7, Third Edition - Third Edition

Wildcard lookups

In Chapter 10, Summary Indexes and CSV Files, we edited transforms.conf but did not explain what was happening. Let's take another look. Our transform stanza looks like this:

[flatten_summary_lookup] 
filename = flatten_summary_lookup.csv 
match_type = WILDCARD(url) 
max_matches = 1

Walking through what we added, we have the following terms and their descriptions:

• match_type = WILDCARD(url): This says that the value of the url field in the lookup file may contain wildcards. In our example, the URL might look like / contact/* in our CSV file.
• max_matches = 1: By default, up to 10 entries that match in the lookup file will be added to an event, with the values in each field being added to a multivalue field. In this case, we ...