Matching key word in CSV with other data

[abbam]

Hi,

I have data in a CSV file which I am pulling in a search.

For example:

|inputlookup data.csv

description title
data here some random title

I have another CSV which contains key words such as:

keywords.csv
Word:
data
random
title

I want to basically match my data.csv with the keywords.csv and create a new column within the splunk search where the keyword matches.

So the outcome should be:

description title matches
data here some random title yes
test test2 no

how can this be achieved?

Thanks

[pgrantham_splun]

If I'm understanding the question correctly, this should do what you're asking for:

| inputlookup data.csv 
| join title type=left [|inputlookup keywords.csv | rename word as title | eval match="yes"]
| eval match=if(isnull(match),"no",match)
| table title description match

Where data.csv contains:
description,title
"here is a description","title"

and keywords.csv contains:
word
"some"
"random"
"title"
"here"

[abbam]

Afraid that doesn't work.

The keywords need to be wildcarded and it needs to be found within a sentence within the data.csv file.

So data.csv includes this sentence:
"this is random data"

keyword.csv file:
random

needs to find the match in the data.csv and output a new field saying that it's matched

[somesoni2 · Accepted solution]

You basically need to do wildcarded lookup between these two lookups. Have a look at these post on steps to implement the same

https://answers.splunk.com/answers/52580/can-we-use-wildcard-characters-in-a-lookup-table.html
https://answers.splunk.com/answers/148245/how-to-create-automatic-wildcard-lookups-against-more-than...

[abbam]

+1 +1 thank you so much! got this working.

[abbam]

I've tried to do something similar but cannot seem to get it working.

How do I reference the CSV as the source in the props.conf file?