topic Re: How do I write a Search that can match a word from 2 different lookup files? in Splunk Search

How do I write a search that can match a word from two different lookup files?

satyaallaparthi — Tue, 09 May 2023 14:32:31 GMT

Hello,

I have 2 different files names lookup1.csv and lookup2.csv, which have column A and column B in both.

How can we merge two files using a single word in Column A in both files with a sentence in it?

lookup1: Column A: "I am good"

lookup2: Column A: "I am bad"

I want to combine both the files using a word "I am" in this case.

Any help would be appreciated.

Re: How do I write a Search that can match a word from 2 different lookup files?

yuanliu — Tue, 09 May 2023 06:21:27 GMT

Can you explain what is the desired output? In other words, what does "match" mean in this context? Is this entire exercise between two lookups or will it involve event data?

Re: How do I write a Search that can match a word from 2 different lookup files?

satyaallaparthi — Tue, 09 May 2023 12:40:24 GMT

Hi,

Entire output will be in between two lookups.

desired output: if there is a word match in between Column A of two files, then I want to display “yes” in a new Column called Matching_word and “no” if there is no word match.

Re: How do I write a Search that can match a word from 2 different lookup files?

yuanliu — Wed, 10 May 2023 08:32:39 GMT

Splunk may not be the best tool for this task because SPL doesn't have a builtin definition of "word". If I take space as word boundary, you can do something like

dc is the basic idea. You can improve/enhance word detection. But there is a limit to what you can do before it becomes labor.

Hope this helps.