Getting Data In

Is it possible to find values that are wrapped by quotation marks in a lookup table?

New Member

I have a lookup table that has values that are wrapped by quotations. For example: "fw: Help".
If I try to search for this by this search:
|inputlookup zyx.csv | search column="fw: Help" nothing comes up.
I have even tried this as well:
|inputlookup zyx.csv | search column=fw: Help

BUT if i do | search column=* it populates all the value in the lookup table which is fine but i need help finding a value that is wrapped around quotation.
How can i do that?
Is it even possible to search for a value that is wrapped in quotations?

Tags (2)
0 Karma
1 Solution

Legend

Hi AbubakarShahid,
if you don't want to modify your lookup, you could use regexes at search time to search using " or to not consider " in searches:

| inputlookup zyx.csv 
| rex field=column "\"(?<newcolumn>[^\"]*)\""
| search new column="fw: Help"

Bye.
Giuseppe

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

Hey @AbubakarShahid, if they solved your problem, remember to "√Accept" an answer to award karma points 🙂

0 Karma

SplunkTrust
SplunkTrust

@AbubakarShahid, please try the following command:

| inputlookup zxy.csv where column="\"fw: Help\""

You would need to escape double quotes in your query using back slash ( \ ).

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Legend

Hi AbubakarShahid,
if you don't want to modify your lookup, you could use regexes at search time to search using " or to not consider " in searches:

| inputlookup zyx.csv 
| rex field=column "\"(?<newcolumn>[^\"]*)\""
| search new column="fw: Help"

Bye.
Giuseppe

View solution in original post

0 Karma

New Member

so this good it actually creates a new column and the the value that have quotation to a new column with out quotations.
what i wanted was this below which workds.
so this works if i do this
| inputlookup URLTEST.csv | rex field=URLTEST "\"(?[^\"])\"" | search URLTEST=
that search will show me all the results.
if i do this
| inputlookup URL
TEST.csv | rex field=URLTEST "\"(?[^\"])\"" | search URLTEST="fw"

it will display "fw: Help"

Thank you so much

0 Karma