Getting Data In

Is it possible to find values that are wrapped by quotation marks in a lookup table?

AbubakarShahid
New Member

I have a lookup table that has values that are wrapped by quotations. For example: "fw: Help".
If I try to search for this by this search:
|inputlookup zyx.csv | search column="fw: Help" nothing comes up.
I have even tried this as well:
|inputlookup zyx.csv | search column=fw: Help

BUT if i do | search column=* it populates all the value in the lookup table which is fine but i need help finding a value that is wrapped around quotation.
How can i do that?
Is it even possible to search for a value that is wrapped in quotations?

Tags (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi AbubakarShahid,
if you don't want to modify your lookup, you could use regexes at search time to search using " or to not consider " in searches:

| inputlookup zyx.csv 
| rex field=column "\"(?<newcolumn>[^\"]*)\""
| search new column="fw: Help"

Bye.
Giuseppe

View solution in original post

0 Karma

lfedak_splunk
Splunk Employee
Splunk Employee

Hey @AbubakarShahid, if they solved your problem, remember to "√Accept" an answer to award karma points 🙂

0 Karma

niketn
Legend

@AbubakarShahid, please try the following command:

| inputlookup zxy.csv where column="\"fw: Help\""

You would need to escape double quotes in your query using back slash ( \ ).

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi AbubakarShahid,
if you don't want to modify your lookup, you could use regexes at search time to search using " or to not consider " in searches:

| inputlookup zyx.csv 
| rex field=column "\"(?<newcolumn>[^\"]*)\""
| search new column="fw: Help"

Bye.
Giuseppe

0 Karma

AbubakarShahid
New Member

so this good it actually creates a new column and the the value that have quotation to a new column with out quotations.
what i wanted was this below which workds.
so this works if i do this
| inputlookup URL_TEST.csv | rex field=URLTEST "\"(?[^\"])\"" | search URLTEST=
that search will show me all the results.
if i do this
| inputlookup URL_TEST.csv | rex field=URLTEST "\"(?[^\"])\"" | search URLTEST="fw"

it will display "fw: Help"

Thank you so much

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...