I'm trying to do a search with a lookup table and can't seem to get the search to perform what I'm wanting. I have some data that produces a table output like below.
_time | user | interesting |
8/18/22 | user1 | a few words here |
I have a lookup table with a list of words in it. The lookup table has a header of "Words" and a list of words separated by line feed. I would like to perform a search where I get back the sub results of the main search where a single word in my lookup matches anywhere in the interesting field. I got a partial match with the following search.
my search terms | lookup WordsLookup.csv Words as Interesting OUTPUT Words | table _time, user, Interesting, Words
In this case, it will return all results for my search terms and only a match where the Interesting field is EXACTLY the lookup of Words. I set WILDCARD(Words) in the lookup definition.
Help? Thanks
I've started to solve my own problem but I have hit a snag... It turns out that I was doing the right thing by setting the lookup definition to WILDCARD(Words) but I wasn't calling the lookup definition, still just the lookup table, oops... I'm using the following and it's kinda working. I had to modify my list of words as such
Words
*word1*
*word2*
my search terms | lookup "My Lookup" Words as Interesting OUTPUT Words | table _time, user, Interesting, Words
Now I get matches, but too many matches.
_time | user | Interesting | Words |
8/18/2022 | user1 | my words1list here | words1 |
The above match is incorrect as I only want full word matches. I tried updating my lookup table to * words1 * (note the space) and that works for "my words1 here" but not "I have words1".