Splunk Search

Can eval if match be used with inputlookup?

chrisfrigo
Path Finder

So what I'm trying trying to achieve is searching a field for contained in a CSV file, not an exact match. I can do this with single word using

| eval catch=if(match(field123,"contain-word"),"matches","other") | search catch=matches

but wondering if there's some way of using inputlookups or if anyone can recommend another way to search a field containing with a input file. This is what I have tried.

| eval catch=if(match(field123,"[| inputlookup input-file]"),"matches","other") | search catch=matches

Tags (2)

Raghav2384
Motivator

Try this logic...

...base search [|inputlookup xyz.csv|eval Catch = if(match(field1,"matching term"),"match","other")|where Catch = "match"|fields Field_i_need_from_lookup]

So basically, you are applying the match function on lookup first and retrieving needed field where Catch = Match and passing it to the parent search.

Hope this helps.

Thanks,
Raghav

0 Karma

chrisfrigo
Path Finder

hmmm... the matching terms are the text contained in the CSV so not sure this will work.

0 Karma

chrisfrigo
Path Finder

I'm trying to search words contained in a CSV file in a particular field, hence why I was trying to use inputlookup in the match criteria.

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...