How do I use inputlookup to create table of string matches from raw events?

[digital_alchemy]

I need to match strings contained in a .csv lookup file to the raw events since there are no field extractions for these strings. I would also like to export this data to a table.

I'm using the following search:

*[| inputlookup MY_LOOKUP_FILE.csv | rename COLUMN_HEADER as search | fields search | format] | eval rawText= _raw | eval hit=[| inputlookup MY_LOOKUP_FILE.csv | stats values(COLUMN_HEADER) as query | eval query=mvjoin(query,",") | fields query | eval query = "".query.""] | eval hit=split(hit,",") | mvexpand hit | eval hit=lower(hit) | eval rawText=lower(rawText) | where like(rawText,"%"+hit+"%") | TABLE *

When I run this search I'm getting the following error:

Error in 'eval' command: The expression is malformed. An unexpected character is reached at ')'.

I can't seem to get this search to work and I'm not sure what the error is.

Any ideas?

[digital_alchemy · Accepted solution]

Ok Figured out that I had a typo I had mistyped the column header in the evals.

[rgcurry]

Without knowing your data or situation, I am curious as to what is keeping you or someone from creating the field extractions needed/wanted to make this work? You could also use the rex command to dynamically create fields from the raw data. Have you played with the Field Extracions page in Manager?

As for the malformed eval error, your search is quite generic to me and I don't see the error. What I do in a situation where I have a lot of evals and cannot see which one is in err is to remove all but the first and run the search, if it works, add the next one back and rerun; repeat as needed until the solution is found.