topic Re: inputlookup question, can't find answer anywhere in Getting Data In

inputlookup question, can't find answer anywhere

jonbalderston — Mon, 28 Sep 2020 14:40:24 GMT

I have a lookup which works, it's not matched to a field, it has to search in the raw event.

[|inputlookup MyFile.csv| fields column_name| rename column_name as search | format]

This finds all results with names in MyFile.csv and highlights in results.

I want to output to a table with the result (what the match was from the CSV file). i.e.
time,StringFound, etc

I can do table, etc with everything else in event, just not what was matched from MyFile.csv

HiroshiSatoh — Thu, 29 Aug 2013 01:19:47 GMT

I think to be able to answer if there is a sample of the data and of the entire search statement.

jpass — Thu, 29 Aug 2013 01:39:38 GMT

This will do the trick. I can't remember where I got it or who helped me put it together but it works...

This assumes your lookup table has a single field called 'phrase'.
For example, if you want to search for any reference to a list of IPs
A column called 'hit' is created
If your events have a unique key (like a primary key) you can at a 'transaction primarykey' to group all events that contain multiple 'hits'

index=yourindex [| inputlookup MyFile.csv | rename phrase as search | fields search | format] | eval rawText= _raw | eval hit=[| inputlookup MyFile.csv | stats values(phrase) as query | eval query=mvjoin(query,",") | fields query | eval query = "\"".query."\""] | eval hit=split(hit,",") | mvexpand hit | eval hit=lower(hit) | eval rawText=lower(rawText) | where like(rawText,"%"+hit+"%") | TABLE *

jonbalderston — Thu, 29 Aug 2013 08:36:04 GMT

It works! I had to change """.query.""" to "".query."" though, otherwise it returns an error. Thanks!!!

jpass — Thu, 29 Aug 2013 13:55:58 GMT

sure no problem. Glad I could help someone as opposed to getting help from others.