Hi Splunk Community,
I wondered if there was any way to match a keyword against a string in a lookup. For example:
I have a lookup containing a field with a string:
items | description |
"orange apple banana" | fruit |
I have this field in my search results:
item
"apple"
|makeresults
| eval item="apple"
Is there any way I can look-up the lookup above to match "apple" against "orange apple banana" and output "fruit" from the description field?
I can achieve the reverse of this with wildcard matching (e.g. "orange apple banana" > *apple*), but haven't been able to find a way to match against a string.
Does anyone know if this is possible?
Thanks
I did this occasionally but it can be very expensive. Something like
| append
[| inputlookup itemslookup.csv
| eval items = split(items, " ")]
| stats values(item) as item values(items) as items values(description) as description
| mvexpand item
| eval description = if(in(item, items), description, null())
The output looks like
item | items | description |
apple | apple banana orange | fruit |
potato | apple banana orange |
This is tested with the following emulation
| makeresults
| fields - _time
| eval item = mvappend("apple", "potato")
| mvexpand item
``` data emulation above ```
Good thinking! Thanks
I did this occasionally but it can be very expensive. Something like
| append
[| inputlookup itemslookup.csv
| eval items = split(items, " ")]
| stats values(item) as item values(items) as items values(description) as description
| mvexpand item
| eval description = if(in(item, items), description, null())
The output looks like
item | items | description |
apple | apple banana orange | fruit |
potato | apple banana orange |
This is tested with the following emulation
| makeresults
| fields - _time
| eval item = mvappend("apple", "potato")
| mvexpand item
``` data emulation above ```