Splunk Search

How to rename fields in a subsearch and keep results of the original field name?

Glasses
Builder

I have a subsearch query that uses a wildcard keyword list as an inputlookup to find filenames that contain a keyword.

I then rename the resulting filenames as keyword to do a reverse lookup to output the keyword that matched the filename.

The problem is I want to list out the filename and the keyword that matched in the filename...

For example>>>

index=foo sourcetype=bar
[|inputlookup keyword-list.csv |fields keyword |rename keyword as FileName] 
| rename FileName as keyword 
| lookup keyword-list.csv keyword OUTPUT keyword as Matched 
| stats values(Matched)

From this query my results are the keywords:
(for example)

*jedi*
*sith*
*falcon*

Here are the FileName results containing the keyword

 index=foo sourcetype=bar
    [|inputlookup keyword-list.csv |fields keyword |rename keyword as FileName] 
    | stats values(FileName)

"D:/Rey Skywalker/jedi/report.pdf"
"D:/Kilo Ren/sith/report.pdf"
"E:/starship/falcon/rebel/report.pdg"

I was requested to list both together in the results... like this

*jedi*    "D:/Rey Skywalker/jedi/report.pdf"        
*sith*    "D:/Kilo Ren/sith/report.pdf"
*falcon*  "E:/starship/falcon/rebel/report.pdg"

Any advice greatly appreciated, thank you!

0 Karma
1 Solution

to4kawa
Ultra Champion
 index=foo sourcetype=bar
 [|inputlookup keyword-list.csv |fields keyword |rename keyword as FileName] 
 | eval keyword = FileName
 | lookup keyword-list.csv keyword OUTPUT keyword as Matched 
 | stats values(Matched) by FileName

I think it ’s okay if you don’t rename

View solution in original post

0 Karma

to4kawa
Ultra Champion
 index=foo sourcetype=bar
 [|inputlookup keyword-list.csv |fields keyword |rename keyword as FileName] 
 | eval keyword = FileName
 | lookup keyword-list.csv keyword OUTPUT keyword as Matched 
 | stats values(Matched) by FileName

I think it ’s okay if you don’t rename

0 Karma

Glasses
Builder

Thank you!!!

I tried something similar but jacked it up... went the wrong way, thanks for your help.

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...