Is it possible to match a string in a lookup against a keyword?

[Ker_splunk]

Hi Splunk Community,

I wondered if there was any way to match a keyword against a string in a lookup.  For example:

I have a lookup containing a field with a string:

items	description
"orange apple banana"	fruit

I have this field in my search results:

item

"apple"

|makeresults
| eval item="apple"

Is there any way I can look-up the lookup above to match "apple" against "orange apple banana" and output "fruit" from the description field?

I can achieve the reverse of this with wildcard matching (e.g. "orange apple banana" > *apple*), but haven't been able to find a way to match against a string.

Does anyone know if this is possible?

Thanks

[Ker_splunk]

Good thinking! Thanks

[yuanliu · Accepted solution]

I did this occasionally but it can be very expensive.  Something like

| append
    [| inputlookup itemslookup.csv
    | eval items = split(items, " ")]
| stats values(item) as item values(items) as items values(description) as description
| mvexpand item
| eval description = if(in(item, items), description, null())

The output looks like

item	items	description
apple	apple banana orange	fruit
potato	apple banana orange

This is tested with the following emulation

| makeresults
| fields - _time
| eval item = mvappend("apple", "potato")
| mvexpand item
``` data emulation above ```