Having some trouble with sub searches and makemv/mvexpand

[sunnyd]

Im trying to do some data mining on twitter for a project. I trying to find keywords that are most popular, and then remove the stop words using a CSV lookup.

Here is my query:

index=football-twitter lang=en earliest=-15m@m latest=@m
| eval foo=text
| makemv foo
| mvexpand foo
| search foo NOT
    [ 
    | inputlookup StopWords.csv 
    | rename Words AS foo ]
| top foo limit=1
| table foo

This does not work.

but if I use a slightly different query, it works.

index=football-twitter lang=en earliest=-15m@m latest=@m
| makemv text
| mvexpand text
| search text NOT
    [ 
    | inputlookup StopWords.csv 
    | rename Words AS text ]
| top text limit=1
| table text

What I want to do, is create a time chart of the usage of the top keyword, and also use the sentiment app to generate a sentiment time chart . Something like -

index=football-twitter lang=en
    [search index=football-twitter lang=en earliest=-15m@m latest=@m
    | makemv text
    | mvexpand text
    | search text NOT
        [ 
            | inputlookup StopWords.csv 
            | rename Words AS text ]
    | top text limit=1
    | table text] 
| sentiment twitter text
| timechart avg(sentiment)

but the query above does not seem to work either.

Any help would be greatly appreciated.

Thanks!

[woodcock]

Sometimes you will have problems with eval if you do not put the RHV string-literal in double-quotes. For example, try this:

... | inputcsv YourFile.csv | eval newField=ThisIsAValueNotAFieldName

The above will NOT create newField but the following will:

... | inputcsv YourFile.csv | eval newField="ThisIsAValueNotAFieldName"

So try changing this part:

| eval foo=text

To this:

| eval foo="text"

[woodcock]

Did this work for you?