Answer by warren for How to search a lookup based on partial match of field values of a base search in splunk

Enable WILDCARD matching in your lookup definition, then do something like:

<first part of search>
| lookup mylookup user AS name_last OUTPUT date intel_source
<rest of search>

Of course, this will only be potentially helpful if user names incorporate aspects of real names

If you have a John Smith whose username is rockinrutabega1970 or 829911882 or sm792ask38 … you’ll be up the proverbial creek with your attempt to "help" 🙂

from User warren – Stack Overflow https://stackoverflow.com/questions/71131587/how-to-search-a-lookup-based-on-partial-match-of-field-values-of-a-base-search-i/71145521#71145521
via IFTTT