How can we compare two dynamic field values from two lookups

Trishla — Tue, 30 Jun 2020 04:16:36 GMT

Hi All,

I am urgently looking for a help . I have one field object_name which is present in lookup X1.csv and has values like
object_name
GRM MGT Shortfirer Appointment
Blasting Security Register Test
Morning Schedule

The other lookup(X2.csv) has the column object_name , which has values like below
Appointment
Schedule
Blasting
I have to match the two columns and give the results , wherever object_name contains *keyword* of object_name from secondlookup.. The field values can be in upper case or lower case or a combination.

Re: How can we compare two dynamic field values from two lookups

bowesmana — Tue, 30 Jun 2020 22:22:49 GMT

It's not clear what exactly you are looking up from each lookup file. So when you have a row with

object_name="Blasting Security Register Test"

then are you wanting to see if any of the 4 words

Blasting
Security
Register
Test

exist in the second lookup file?

What you can do is based on the following example

This will create a lookup file with the 4 words separated onto individual rows with a value n=1 for each

This second snippet with then create a test sample where there are two rows, one with the name as above and the other with a name where the fields are not present.

Essentially what this is doing is to split the words from the object_name and then do a multivalue lookup of those words into the lookup file.

By then testing the existence of n, you will know if the match is found

| where !isnull(n)

You will need to create not just the lookup file, but also the lookup definition where you say that lookups are case insensitive, so you do the lookup on the definition NOT the lookup file itself.

Hope this helps

topic How can we compare two dynamic field values from two lookups in Splunk Search

How can we compare two dynamic field values from two lookups

Re: How can we compare two dynamic field values from two lookups