Comparing field value results to values(alphanumeric) in lookup file

[harishkothandar]

I am trying to compare the field values of a lookup file(alphanumeric values) to the my search results. Please help me with the search command. This is to compare file extensions with that of the blacklisted extensions and to create an alert when it matches.

Lookup :

Extensions Name
.xml XML
.py Python
.sh Shell

Comparing the extensions filed with the results that i get is what i need to do.

[jkat54]

Try this:

Match what’s in the lookup:

 index=test [|inputlookup lookupname.csv | fields fieldFromLookup | format ]

Will turn into this:

index=test ((fieldFromLookup=valueFromRow1) OR (fieldFromLookup=valueFromRow2) ...)

If the field name in the lookup is different from the fiel name in your index, add a rename to the subseaech:

index=test [|inputlookup lookupname.csv | fields fieldFromLookup | rename fieldFromLookup as fieldInData | format ]