Im trying to do some data mining on twitter for a project. I trying to find keywords that are most popular, and then remove the stop words using a CSV lookup.
Here is my query:
index=football-twitter lang=en earliest=-15m@m latest=@m
| eval foo=text
| makemv foo
| mvexpand foo
| search foo NOT
[
| inputlookup StopWords.csv
| rename Words AS foo ]
| top foo limit=1
| table foo
This does not work.
but if I use a slightly different query, it works.
index=football-twitter lang=en earliest=-15m@m latest=@m
| makemv text
| mvexpand text
| search text NOT
[
| inputlookup StopWords.csv
| rename Words AS text ]
| top text limit=1
| table text
What I want to do, is create a time chart of the usage of the top keyword, and also use the sentiment app to generate a sentiment time chart . Something like -
index=football-twitter lang=en
[search index=football-twitter lang=en earliest=-15m@m latest=@m
| makemv text
| mvexpand text
| search text NOT
[
| inputlookup StopWords.csv
| rename Words AS text ]
| top text limit=1
| table text]
| sentiment twitter text
| timechart avg(sentiment)
but the query above does not seem to work either.
Any help would be greatly appreciated.
Thanks!
Sometimes you will have problems with eval
if you do not put the RHV string-literal in double-quotes. For example, try this:
... | inputcsv YourFile.csv | eval newField=ThisIsAValueNotAFieldName
The above will NOT create newField
but the following will:
... | inputcsv YourFile.csv | eval newField="ThisIsAValueNotAFieldName"
So try changing this part:
| eval foo=text
To this:
| eval foo="text"
Did this work for you?