Getting Data In
Provide Splunk Cloud feedback in this confidential UX survey by June 17
for a chance to win a $200 Amazon gift card!

How do I use inputlookup to create table of string matches from raw events?

digital_alchemy
Path Finder

I need to match strings contained in a .csv lookup file to the raw events since there are no field extractions for these strings. I would also like to export this data to a table.

I'm using the following search:

*[| inputlookup MY_LOOKUP_FILE.csv | rename COLUMN_HEADER as search | fields search | format] | eval rawText= _raw | eval hit=[| inputlookup MY_LOOKUP_FILE.csv | stats values(COLUMN_HEADER) as query | eval query=mvjoin(query,",") | fields query | eval query = "".query.""] | eval hit=split(hit,",") | mvexpand hit | eval hit=lower(hit) | eval rawText=lower(rawText) | where like(rawText,"%"+hit+"%") | TABLE *

When I run this search I'm getting the following error:

Error in 'eval' command: The expression is malformed. An unexpected character is reached at ')'.

I can't seem to get this search to work and I'm not sure what the error is.

Any ideas?

0 Karma
1 Solution

digital_alchemy
Path Finder

Ok Figured out that I had a typo I had mistyped the column header in the evals.

View solution in original post

0 Karma

digital_alchemy
Path Finder

Ok Figured out that I had a typo I had mistyped the column header in the evals.

View solution in original post

0 Karma

rgcurry
Contributor

Without knowing your data or situation, I am curious as to what is keeping you or someone from creating the field extractions needed/wanted to make this work? You could also use the rex command to dynamically create fields from the raw data. Have you played with the Field Extracions page in Manager?

As for the malformed eval error, your search is quite generic to me and I don't see the error. What I do in a situation where I have a lot of evals and cannot see which one is in err is to remove all but the first and run the search, if it works, add the next one back and rerun; repeat as needed until the solution is found.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!