Splunk Search
Highlighted

Search for a pattern in a lookup CSV file which is received from first search from another lookup CSV file

Communicator

I have two lookup csv files.
file1.csv and file2.csv

1st query results me with field1 which has a pattern match in field2 of file2.csv not the exact match.

how can i achieve this in query .

Thanks

0 Karma
Highlighted

Re: Search for a pattern in a lookup CSV file which is received from first search from another lookup CSV file

Legend

Hi surekhasplunk,
try something like this:

| inputlookup file1.csv
| search [ | inputlookup file2.csv | eval field1="*"+field2+"*" | fields field1 ]
| table .....

Bye.
Giuseppe

View solution in original post

0 Karma
Highlighted

Re: Search for a pattern in a lookup CSV file which is received from first search from another lookup CSV file

Communicator

thanks @cusello,

It worked well with the numeric field data but somehow returning 0 results for character fields.
i have something filed1 value from file1.csv which looks like "APPLICATION SUPP" and i have
field2 value from file2.csv which looks like "Application Support"
so am doing a
| inputlookup file1.csv | eval a1=substr(field1,13,3) | eval a1=lower(a1)
| search [ | inputlookup file2.csv |eval a1=substr(field1,13,3)| eval b1=""+a1+""| eval field1=""+b1+"" | fields field1 ]
| table .....

but getting 0 rows returned

0 Karma