Is it possible to find values that are wrapped by quotation marks in a lookup table?

[AbubakarShahid]

I have a lookup table that has values that are wrapped by quotations. For example: "fw: Help".
If I try to search for this by this search:
|inputlookup zyx.csv | search column="fw: Help" nothing comes up.
I have even tried this as well:
|inputlookup zyx.csv | search column=fw: Help

BUT if i do | search column=* it populates all the value in the lookup table which is fine but i need help finding a value that is wrapped around quotation.
How can i do that?
Is it even possible to search for a value that is wrapped in quotations?

[lfedak_splunk]

Hey @AbubakarShahid, if they solved your problem, remember to "√Accept" an answer to award karma points 🙂

[niketn]

@AbubakarShahid, please try the following command:

| inputlookup zxy.csv where column="\"fw: Help\""

You would need to escape double quotes in your query using back slash ( \ ).

[gcusello · Accepted solution]

Hi AbubakarShahid,
if you don't want to modify your lookup, you could use regexes at search time to search using " or to not consider " in searches:

| inputlookup zyx.csv 
| rex field=column "\"(?<newcolumn>[^\"]*)\""
| search new column="fw: Help"

Bye.
Giuseppe

[AbubakarShahid]

so this good it actually creates a new column and the the value that have quotation to a new column with out quotations.
what i wanted was this below which workds.
so this works if i do this
| inputlookup URL_TEST.csv | rex field=URLTEST "\"(?[^\"])\"" | search URLTEST=
that search will show me all the results.
if i do this
| inputlookup URL_TEST.csv | rex field=URLTEST "\"(?[^\"])\"" | search URLTEST="fw"

it will display "fw: Help"

Thank you so much