https://community.splunk.com/t5/Getting-Data-In/I-have-some-data-if-the-message-contains-a-word-which-is-in-a/m-p/341528#M62919 <P>I have some data, if the message contains a word which is in a csv file, then results should show in a table. How should I edit my search?</P> <P>I have a csv file which contains keywords like:</P> <P>kill<BR /> bomb <BR /> gun <BR /> drugs<BR /> Anthrax<BR /> Arms<BR /> Attack<BR /> Atomic<BR /> If the message contains more than one word like:</P> <P>take your gun<BR /> kill him<BR /> And I search like this:</P> <P>search | table message, id ,name<BR /> then results should look like this:</P> <P>message id name</P> Sat, 22 Apr 2017 02:53:43 GMT nagarjuna280 2017-04-22T02:53:43Z https://community.splunk.com/t5/Getting-Data-In/I-have-some-data-if-the-message-contains-a-word-which-is-in-a/m-p/341528#M62919 <P>I have some data, if the message contains a word which is in a csv file, then results should show in a table. How should I edit my search?</P> <P>I have a csv file which contains keywords like:</P> <P>kill<BR /> bomb <BR /> gun <BR /> drugs<BR /> Anthrax<BR /> Arms<BR /> Attack<BR /> Atomic<BR /> If the message contains more than one word like:</P> <P>take your gun<BR /> kill him<BR /> And I search like this:</P> <P>search | table message, id ,name<BR /> then results should look like this:</P> <P>message id name</P> Sat, 22 Apr 2017 02:53:43 GMT https://community.splunk.com/t5/Getting-Data-In/I-have-some-data-if-the-message-contains-a-word-which-is-in-a/m-p/341528#M62919 nagarjuna280 2017-04-22T02:53:43Z https://community.splunk.com/t5/Getting-Data-In/I-have-some-data-if-the-message-contains-a-word-which-is-in-a/m-p/341529#M62920 <P>Following query creates a dummy lookup using makeresults (In case of lookup file you can use <STRONG>inputlookup</STRONG> command instead.)</P> <PRE><CODE>| makeresults | eval findPattern="kill,bomb,gun,drugs,Anthrax,Arms,Attack,Atomic" | makemv delim="," findPattern | mvexpand findPattern limit=10 </CODE></PRE> <P>Splunk's <STRONG>map</STRONG> command would be able to iterate though the keywords in the previous query</P> <PRE><CODE>| map search="| makeresults | eval testData=\"Chuck Norris doesn't need gun to kill\"| eval matched=if(match(testData,\"$findPattern$\"),1,0)" | search matched="1" | stats sum(matched) as matched by testData | table testData, matched </CODE></PRE> <P>Combine the above two search which is a run anywhere example.</P> Sun, 23 Apr 2017 08:03:01 GMT https://community.splunk.com/t5/Getting-Data-In/I-have-some-data-if-the-message-contains-a-word-which-is-in-a/m-p/341529#M62920 niketn 2017-04-23T08:03:01Z https://community.splunk.com/t5/Getting-Data-In/I-have-some-data-if-the-message-contains-a-word-which-is-in-a/m-p/341530#M62921 <P>I have a .csv file whose name is bad.csv in which the column name is eventuei I want that column to be displayed in my report.<BR /> Please let me know how to pull the .csv file inside the query and display the "eventuei" column in the report.</P> Fri, 05 Oct 2018 07:01:10 GMT https://community.splunk.com/t5/Getting-Data-In/I-have-some-data-if-the-message-contains-a-word-which-is-in-a/m-p/341530#M62921 viji261992 2018-10-05T07:01:10Z