Hi,
I have data in a CSV file which I am pulling in a search.
For example:
|inputlookup data.csv
description title
data here some random title
I have another CSV which contains key words such as:
keywords.csv
Word:
data
random
title
I want to basically match my data.csv with the keywords.csv and create a new column within the splunk search where the keyword matches.
So the outcome should be:
description title matches
data here some random title yes
test test2 no
how can this be achieved?
Thanks
You basically need to do wildcarded lookup between these two lookups. Have a look at these post on steps to implement the same
https://answers.splunk.com/answers/52580/can-we-use-wildcard-characters-in-a-lookup-table.html
https://answers.splunk.com/answers/148245/how-to-create-automatic-wildcard-lookups-against-more-than...
If I'm understanding the question correctly, this should do what you're asking for:
| inputlookup data.csv
| join title type=left [|inputlookup keywords.csv | rename word as title | eval match="yes"]
| eval match=if(isnull(match),"no",match)
| table title description match
Where data.csv contains:
description,title
"here is a description","title"
and keywords.csv contains:
word
"some"
"random"
"title"
"here"
Afraid that doesn't work.
The keywords need to be wildcarded and it needs to be found within a sentence within the data.csv file.
So data.csv includes this sentence:
"this is random data"
keyword.csv file:
random
needs to find the match in the data.csv and output a new field saying that it's matched
You basically need to do wildcarded lookup between these two lookups. Have a look at these post on steps to implement the same
https://answers.splunk.com/answers/52580/can-we-use-wildcard-characters-in-a-lookup-table.html
https://answers.splunk.com/answers/148245/how-to-create-automatic-wildcard-lookups-against-more-than...
+1 +1 thank you so much! got this working.
I've tried to do something similar but cannot seem to get it working.
How do I reference the CSV as the source in the props.conf file?