I have an mvfield of type string in my results.
I want to search and match all values of this field for words that come from a csv lookup.
LookupRows:
{row1, "mary white"}
{row2, "Tom White"}
Results
Astring="Mary had a white lamb" , "tom had none" , "Joe was here"
Astring="No match here" , "tom thumb"
Searching with the lookup values against the full text of the event is not an acceptable answer.
Resolved using a _raw rename.
BaseSearch | eval MyRaw=_raw | mvexpand Astring | eval _raw=Astring | search [|inputlookup searchterms.csv] | table _time, Astring
Resolved using a _raw rename.
BaseSearch | eval MyRaw=_raw | mvexpand Astring | eval _raw=Astring | search [|inputlookup searchterms.csv] | table _time, Astring