I have a subsearch query that uses a wildcard keyword list as an inputlookup to find filenames that contain a keyword.
I then rename the resulting filenames as keyword to do a reverse lookup to output the keyword that matched the filename.
The problem is I want to list out the filename and the keyword that matched in the filename...
For example>>>
index=foo sourcetype=bar
[|inputlookup keyword-list.csv |fields keyword |rename keyword as FileName]
| rename FileName as keyword
| lookup keyword-list.csv keyword OUTPUT keyword as Matched
| stats values(Matched)
From this query my results are the keywords:
(for example)
*jedi*
*sith*
*falcon*
Here are the FileName results containing the keyword
index=foo sourcetype=bar
[|inputlookup keyword-list.csv |fields keyword |rename keyword as FileName]
| stats values(FileName)
"D:/Rey Skywalker/jedi/report.pdf"
"D:/Kilo Ren/sith/report.pdf"
"E:/starship/falcon/rebel/report.pdg"
I was requested to list both together in the results... like this
*jedi* "D:/Rey Skywalker/jedi/report.pdf"
*sith* "D:/Kilo Ren/sith/report.pdf"
*falcon* "E:/starship/falcon/rebel/report.pdg"
Any advice greatly appreciated, thank you!
index=foo sourcetype=bar
[|inputlookup keyword-list.csv |fields keyword |rename keyword as FileName]
| eval keyword = FileName
| lookup keyword-list.csv keyword OUTPUT keyword as Matched
| stats values(Matched) by FileName
I think it ’s okay if you don’t rename
index=foo sourcetype=bar
[|inputlookup keyword-list.csv |fields keyword |rename keyword as FileName]
| eval keyword = FileName
| lookup keyword-list.csv keyword OUTPUT keyword as Matched
| stats values(Matched) by FileName
I think it ’s okay if you don’t rename
Thank you!!!
I tried something similar but jacked it up... went the wrong way, thanks for your help.