Splunk Search

How to match the search string presence in lookuptable and show the presence as yes or not in result table

akshayinnamuri
Loves-to-Learn Lots

Hi Guys,

I have a string say example : abc

this string I want to lookup and match the presence in a lookup table  | lookuptable test.csv

test.csv has value

Number Value
1xyz
2abc
3mnp
4wgf

 

I want to check the presence of my search string abc in lookup table and shows me yes or no in result table

Like if found in lookuptable should result me as Yes else NO

example abc is present in lookuptable so my output should be

Search stringPresence
abcYes

 

my search string abc

| inputlookup test.csv| table value | rename value AS V1
| eval x="searchstring"
| eval y="v1"
| eval match=if(match(x,y),1,0)
| where match=1
| table Searchstring, Yes

 

I tried this but didnt get result

Kindly help me !

Thanks in advance

Labels (3)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Firstly, you're mixing cases. With field names v1 is not the same as V1.

Secondly, you're setting y to a literal "v1" string. It has nothing to do with the v1 field (mind also the case remark above).

Thirdly, the match() function is a regex match.

And lastly - will you be trying to integrate it into some bigger search? If so, then you'll probably need some another approach.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Do you mean something like this?

| inputlookup test.csv
| table value 
| rename value AS V1
| eval x="searchstring"
| eval presence=if(match(V1,x),"Yes","No")
| where presense="Yes"
| table V1, presence
0 Karma

akshayinnamuri
Loves-to-Learn Lots

Thanks for the response but 

when I try same logic I didnt get any result

resulting table should tell me if present yes and if not present no

 

I tried above but only shows no result found

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try without the where command

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...

Index This | How many sevens are there between 1 and 100?

August 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...