Splunk Search

search using terms from lookup in an (mv) string field.

drodman29
Path Finder

I have an mvfield  of type string in my results. 

I want to search and match all values of this field for words that come from a csv lookup. 

LookupRows: 

{row1, "mary white"} 

{row2, "Tom White"} 

Results

Astring="Mary had a white lamb" , "tom had none" , "Joe was here" 

Astring="No match here" , "tom thumb" 

Searching with the lookup values against the full text of the event is not an acceptable answer. 

Labels (2)
0 Karma
1 Solution

drodman29
Path Finder

Resolved using a _raw rename. 

BaseSearch | eval MyRaw=_raw | mvexpand Astring | eval _raw=Astring | search [|inputlookup searchterms.csv] | table _time, Astring 

View solution in original post

0 Karma

drodman29
Path Finder

Resolved using a _raw rename. 

BaseSearch | eval MyRaw=_raw | mvexpand Astring | eval _raw=Astring | search [|inputlookup searchterms.csv] | table _time, Astring 

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...