Getting Data In

How do I use inputlookup to create table of string matches from raw events?

digital_alchemy
Path Finder

I need to match strings contained in a .csv lookup file to the raw events since there are no field extractions for these strings. I would also like to export this data to a table.

I'm using the following search:

*[| inputlookup MY_LOOKUP_FILE.csv | rename COLUMN_HEADER as search | fields search | format] | eval rawText= _raw | eval hit=[| inputlookup MY_LOOKUP_FILE.csv | stats values(COLUMN_HEADER) as query | eval query=mvjoin(query,",") | fields query | eval query = "".query.""] | eval hit=split(hit,",") | mvexpand hit | eval hit=lower(hit) | eval rawText=lower(rawText) | where like(rawText,"%"+hit+"%") | TABLE *

When I run this search I'm getting the following error:

Error in 'eval' command: The expression is malformed. An unexpected character is reached at ')'.

I can't seem to get this search to work and I'm not sure what the error is.

Any ideas?

0 Karma
1 Solution

digital_alchemy
Path Finder

Ok Figured out that I had a typo I had mistyped the column header in the evals.

View solution in original post

0 Karma

digital_alchemy
Path Finder

Ok Figured out that I had a typo I had mistyped the column header in the evals.

0 Karma

rgcurry
Contributor

Without knowing your data or situation, I am curious as to what is keeping you or someone from creating the field extractions needed/wanted to make this work? You could also use the rex command to dynamically create fields from the raw data. Have you played with the Field Extracions page in Manager?

As for the malformed eval error, your search is quite generic to me and I don't see the error. What I do in a situation where I have a lot of evals and cannot see which one is in err is to remove all but the first and run the search, if it works, add the next one back and rerun; repeat as needed until the solution is found.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...