Matching keywords from raw events and tag specific keywords to respective static lookup columns

[manish_singh_77]

Hi All,

I am trying to match keywords from raw events and then try to tag respective keywords to the relevant columns present in the static lookup.

Here is my query

index=abc cpu OR memory OR disk OR Error OR Fatal OR shutdown
| rex field=_raw "(?|cpu|memory|disk|Error|Fatal|shutdown)"|join type=left comonfieldname[inputlookup testing.csv]

But I also want to match the keywords to the respective columns

For example if the keywords is cpu then it should be mapped to all the four columns correctly in the lookup

[dmarling]

Can you provide more information on what field in your lookup file you would be matching? If you the value of cpu, memory, disk, Error, Fatal, and shutdown are in a specific field, you just need to make your rex extraction be that field name:

| rex field=_raw "(?<fieldNameinCSV>(cpu|memory|disk|Error|Fatal|shutdown))"
| lookup testing.csv fieldNameinCSV

[manish_singh_77]

Let me explain you, I have 4 columns in my lookup table and when any keywords are found from the raw data of the indexes then it should get tagged to the following columns of the lookup
For instance, I get cpu keywords in the raw data then it should tag against the respective cpu columns of the lookup table

[dmarling]

If you could give an example of what is in your lookup table for each one of the use cases, it would make it significantly easier to write a query that accomplishes your requirements. I believe I understand what you are asking for, but I need that example to create a query that accomplishes what you need. Thank you!

[manish_singh_77]

This is not working for me