Refine your search:

4
3

When a field value is passed to a lookup, what are the limits on how it can match the value in the lookup? Specifically:

  • Is the match case-sensitive? If not, what locale rules are used? Similarly, is it diacritic-sensitive?
  • Are any kinds of wildcards allowed? Can I use, e.g., * or Prefix-* in a lookup table and expect it to match an event field value like Prefix-1?

asked 17 Mar '10, 21:19

gkanapathy's gravatar image

gkanapathy ♦
26.5k1622
accept rate: 42%

edited 28 Mar '10, 07:38


One Answer:

Matches are case sensitive as well as diacritic-sensitive.

No wildcards are allowed at this time.

link

answered 08 Apr '10, 17:33

steveyz's gravatar image

steveyz ♦
1.1k14
accept rate: 55%

Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×335
×189

Asked: 17 Mar '10, 21:19

Seen: 795 times

Last updated: 08 Apr '10, 17:33

Copyright © 2005-2012 Splunk, Inc. All rights reserved.