https://community.splunk.com/t5/Splunk-Search/How-to-send-a-partial-string-value-to-a-lookup-table-and-count/m-p/222912#M65565 <P>I have a field that contains a sentence such as "I love wonderful food!" I want to be able to check each word against a lookup table to determine if the sentence was positive or negative. I need to be able to track the count of each good and bad word and give the sentence a score. So for the above sentence the score would be +2. </P> <P>Lookup Table<BR /> Good | Bad<BR /> love | hate<BR /> wonderful| </P> <P>Is this possible with a lookup table or would it potentially be easier to turn the entire event into raw text and search against a multi valued field?</P> Fri, 11 Sep 2015 21:26:51 GMT LWilliamson1 2015-09-11T21:26:51Z https://community.splunk.com/t5/Splunk-Search/How-to-send-a-partial-string-value-to-a-lookup-table-and-count/m-p/222912#M65565 <P>I have a field that contains a sentence such as "I love wonderful food!" I want to be able to check each word against a lookup table to determine if the sentence was positive or negative. I need to be able to track the count of each good and bad word and give the sentence a score. So for the above sentence the score would be +2. </P> <P>Lookup Table<BR /> Good | Bad<BR /> love | hate<BR /> wonderful| </P> <P>Is this possible with a lookup table or would it potentially be easier to turn the entire event into raw text and search against a multi valued field?</P> Fri, 11 Sep 2015 21:26:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-send-a-partial-string-value-to-a-lookup-table-and-count/m-p/222912#M65565 LWilliamson1 2015-09-11T21:26:51Z https://community.splunk.com/t5/Splunk-Search/How-to-send-a-partial-string-value-to-a-lookup-table-and-count/m-p/222913#M65566 <P><STRONG>Maybe try something like this:</STRONG></P> <P>sourcetype=word_parse | eval clean_sentence = replace(sentence, , ""&gt; | eval parsed_sentence = split(clean_sentence, " ") | mvexpand parsed_sentence | lookup point_lookup word as parsed_sentence OUTPUT score | stats sum(score) as total</P> <P><STRONG>You might want to try a lookup table like this:</STRONG></P> <P>Lookup point_lookup:<BR /> word | score<BR /> Good | 1<BR /> Bad | -1<BR /> love | 1<BR /> hate | -1<BR /> wonderful| 1</P> Tue, 29 Sep 2020 07:15:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-send-a-partial-string-value-to-a-lookup-table-and-count/m-p/222913#M65566 jaredlaney 2020-09-29T07:15:55Z https://community.splunk.com/t5/Splunk-Search/How-to-send-a-partial-string-value-to-a-lookup-table-and-count/m-p/222914#M65567 <P>Edit: I think it's something in the back end throwing an error for this particular search.</P> <P>I like your idea but for some reason it's giving no output. I changed your search to:</P> <P>... |eval clean_sentence = replace(sentence,' ',"") | eval parsed_sentence = split(clean_sentence, " ") | mvexpand parsed_sentence | lookup point_lookup word as parsed_sentence OUTPUT score | stats sum(score) as total </P> <P>but it appears to generate no output/matches. </P> Tue, 29 Sep 2020 07:15:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-send-a-partial-string-value-to-a-lookup-table-and-count/m-p/222914#M65567 LWilliamson1 2020-09-29T07:15:57Z https://community.splunk.com/t5/Splunk-Search/How-to-send-a-partial-string-value-to-a-lookup-table-and-count/m-p/222915#M65568 <P>Can you tell me what lookup you used and what the input sentence is?</P> Sun, 13 Sep 2015 06:10:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-send-a-partial-string-value-to-a-lookup-table-and-count/m-p/222915#M65568 jaredlaney 2015-09-13T06:10:09Z https://community.splunk.com/t5/Splunk-Search/How-to-send-a-partial-string-value-to-a-lookup-table-and-count/m-p/222916#M65569 <P>I recreated my lookup in the same manner as you did and named it point_lookup. The input sentence could be anything from "I love my iphone" to "I hate my iphone". The input is actually twitter data.</P> Mon, 14 Sep 2015 02:23:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-send-a-partial-string-value-to-a-lookup-table-and-count/m-p/222916#M65569 LWilliamson1 2015-09-14T02:23:35Z