All Apps and Add-ons

Having some trouble with sub searches and makemv/mvexpand

sunnyd
Engager

Im trying to do some data mining on twitter for a project. I trying to find keywords that are most popular, and then remove the stop words using a CSV lookup.

Here is my query:

index=football-twitter lang=en earliest=-15m@m latest=@m
| eval foo=text
| makemv foo
| mvexpand foo
| search foo NOT
    [ 
    | inputlookup StopWords.csv 
    | rename Words AS foo ]
| top foo limit=1
| table foo

This does not work.

but if I use a slightly different query, it works.

index=football-twitter lang=en earliest=-15m@m latest=@m
| makemv text
| mvexpand text
| search text NOT
    [ 
    | inputlookup StopWords.csv 
    | rename Words AS text ]
| top text limit=1
| table text

What I want to do, is create a time chart of the usage of the top keyword, and also use the sentiment app to generate a sentiment time chart . Something like -

index=football-twitter lang=en
    [search index=football-twitter lang=en earliest=-15m@m latest=@m
    | makemv text
    | mvexpand text
    | search text NOT
        [ 
            | inputlookup StopWords.csv 
            | rename Words AS text ]
    | top text limit=1
    | table text] 
| sentiment twitter text
| timechart avg(sentiment)

but the query above does not seem to work either.

Any help would be greatly appreciated.

Thanks!

0 Karma

woodcock
Esteemed Legend

Sometimes you will have problems with eval if you do not put the RHV string-literal in double-quotes. For example, try this:

... | inputcsv YourFile.csv | eval newField=ThisIsAValueNotAFieldName

The above will NOT create newField but the following will:

... | inputcsv YourFile.csv | eval newField="ThisIsAValueNotAFieldName"

So try changing this part:

| eval foo=text

To this:

| eval foo="text"
0 Karma

woodcock
Esteemed Legend

Did this work for you?

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...