topic Re: Matching key word in CSV with other data in Getting Data In

Matching key word in CSV with other data

abbam — Thu, 18 Aug 2016 15:11:12 GMT

Hi,

I have data in a CSV file which I am pulling in a search.

For example:

|inputlookup data.csv

description title
data here some random title

I have another CSV which contains key words such as:

keywords.csv
Word:
data
random
title

I want to basically match my data.csv with the keywords.csv and create a new column within the splunk search where the keyword matches.

So the outcome should be:

description title matches
data here some random title yes
test test2 no

how can this be achieved?

Thanks

Re: Matching key word in CSV with other data

somesoni2 — Thu, 18 Aug 2016 17:02:22 GMT

You basically need to do wildcarded lookup between these two lookups. Have a look at these post on steps to implement the same

https://answers.splunk.com/answers/52580/can-we-use-wildcard-characters-in-a-lookup-table.html
https://answers.splunk.com/answers/148245/how-to-create-automatic-wildcard-lookups-against-more-than-one-field-in-a-csv-file.html

Re: Matching key word in CSV with other data

pgrantham_splun — Thu, 18 Aug 2016 17:50:55 GMT

If I'm understanding the question correctly, this should do what you're asking for:

| inputlookup data.csv 
| join title type=left [|inputlookup keywords.csv | rename word as title | eval match="yes"]
| eval match=if(isnull(match),"no",match)
| table title description match

Where data.csv contains:
description,title
"here is a description","title"

and keywords.csv contains:
word
"some"
"random"
"title"
"here"

Re: Matching key word in CSV with other data

abbam — Fri, 19 Aug 2016 08:44:02 GMT

I've tried to do something similar but cannot seem to get it working.

How do I reference the CSV as the source in the props.conf file?

Re: Matching key word in CSV with other data

abbam — Fri, 19 Aug 2016 08:45:23 GMT

Afraid that doesn't work.

The keywords need to be wildcarded and it needs to be found within a sentence within the data.csv file.

So data.csv includes this sentence:
"this is random data"

keyword.csv file:
random

needs to find the match in the data.csv and output a new field saying that it's matched

Re: Matching key word in CSV with other data

abbam — Fri, 19 Aug 2016 08:57:55 GMT

+1 +1 thank you so much! got this working.