Splunk Search

How to rename fields in a subsearch and keep results of the original field name?

Glasses
Builder

I have a subsearch query that uses a wildcard keyword list as an inputlookup to find filenames that contain a keyword.

I then rename the resulting filenames as keyword to do a reverse lookup to output the keyword that matched the filename.

The problem is I want to list out the filename and the keyword that matched in the filename...

For example>>>

index=foo sourcetype=bar
[|inputlookup keyword-list.csv |fields keyword |rename keyword as FileName] 
| rename FileName as keyword 
| lookup keyword-list.csv keyword OUTPUT keyword as Matched 
| stats values(Matched)

From this query my results are the keywords:
(for example)

*jedi*
*sith*
*falcon*

Here are the FileName results containing the keyword

 index=foo sourcetype=bar
    [|inputlookup keyword-list.csv |fields keyword |rename keyword as FileName] 
    | stats values(FileName)

"D:/Rey Skywalker/jedi/report.pdf"
"D:/Kilo Ren/sith/report.pdf"
"E:/starship/falcon/rebel/report.pdg"

I was requested to list both together in the results... like this

*jedi*    "D:/Rey Skywalker/jedi/report.pdf"        
*sith*    "D:/Kilo Ren/sith/report.pdf"
*falcon*  "E:/starship/falcon/rebel/report.pdg"

Any advice greatly appreciated, thank you!

0 Karma
1 Solution

to4kawa
Ultra Champion
 index=foo sourcetype=bar
 [|inputlookup keyword-list.csv |fields keyword |rename keyword as FileName] 
 | eval keyword = FileName
 | lookup keyword-list.csv keyword OUTPUT keyword as Matched 
 | stats values(Matched) by FileName

I think it ’s okay if you don’t rename

View solution in original post

0 Karma

to4kawa
Ultra Champion
 index=foo sourcetype=bar
 [|inputlookup keyword-list.csv |fields keyword |rename keyword as FileName] 
 | eval keyword = FileName
 | lookup keyword-list.csv keyword OUTPUT keyword as Matched 
 | stats values(Matched) by FileName

I think it ’s okay if you don’t rename

0 Karma

Glasses
Builder

Thank you!!!

I tried something similar but jacked it up... went the wrong way, thanks for your help.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...