How to check for search string/data present in csv lookuptable and result present or not

akshayinnamuri — Thu, 10 Feb 2022 11:30:08 GMT

I am looking for something like this as below

I have a seach string = rubi
and want to check this string presence in a lookuptable = metals.csv

Name date region
rubi 12122021 abc
diamond 12122022 def
platinum 12122023 ghi

what would be my splunk query to shows the presence of my search string with lookuptable.

I want the result to be something like below

Since in above example rubi is present in metals.csv my result table should look like with an extra column Present and status as Yes

Name Present
rubi Yes

If not present say example searchstring=copper and is not present in metals.csv then output table should be
Name Present
copper No

Note: I am giving the seachstring in text box of dashboard and want a result table as above

Re: How to check for search string/data present in csv lookuptable and result present or not

ITWhisperer — Thu, 10 Feb 2022 12:48:12 GMT

| eval Name="rubi" | lookup metals.csv | eval Present=if(isnull(region),"No","Yes")