This question is extension of the question asked here
http://splunk-base.splunk.com/answers/61664/search-set-of-strings-from-lookup-and-list-count-of-occu...
Assumption
All other assumptions mentioned in the question in link above holds good
yourStringFieldName,yourStringFieldNameTwo search_string_A,search_string_A_05 search_string_B,search_string_B_10 search_string_C,search_string_C_05
Actual command
[| inputlookup your_lookup_here | rename yourStringFieldName as search | fields search | format]
| rename _raw as rawText
| eval foo=[| inputlookup your_lookup_here | stats values(yourStringFieldNameTwo) as query | eval query=mvjoin(query,",")
| fields query
| eval query="\"".query."\"" ]
| eval foo=split(foo,",")
| mvexpand foo
| eval rawText=lower(rawText)
| where like(rawText,"%"+lower(substr(foo,1,len(foo)-3))+"%")
| eval fooC = tonumber(substr(foo,-2))
| eval foo = substr(foo,1,len(foo)-3)
| stats count by foo fooC
| where count >= fooC
This question is extension of the question asked here
http://splunk-base.splunk.com/answers/61664/search-set-of-strings-from-lookup-and-list-count-of-occu...
Assumption
All other assumptions mentioned in the question in link above holds good
yourStringFieldName,yourStringFieldNameTwo search_string_A,search_string_A_05 search_string_B,search_string_B_10 search_string_C,search_string_C_05
Actual command
[| inputlookup your_lookup_here | rename yourStringFieldName as search | fields search | format]
| rename _raw as rawText
| eval foo=[| inputlookup your_lookup_here | stats values(yourStringFieldNameTwo) as query | eval query=mvjoin(query,",")
| fields query
| eval query="\"".query."\"" ]
| eval foo=split(foo,",")
| mvexpand foo
| eval rawText=lower(rawText)
| where like(rawText,"%"+lower(substr(foo,1,len(foo)-3))+"%")
| eval fooC = tonumber(substr(foo,-2))
| eval foo = substr(foo,1,len(foo)-3)
| stats count by foo fooC
| where count >= fooC