Splunk Search

search using terms from lookup in an (mv) string field.

drodman29
Path Finder

I have an mvfield  of type string in my results. 

I want to search and match all values of this field for words that come from a csv lookup. 

LookupRows: 

{row1, "mary white"} 

{row2, "Tom White"} 

Results

Astring="Mary had a white lamb" , "tom had none" , "Joe was here" 

Astring="No match here" , "tom thumb" 

Searching with the lookup values against the full text of the event is not an acceptable answer. 

Labels (2)
0 Karma
1 Solution

drodman29
Path Finder

Resolved using a _raw rename. 

BaseSearch | eval MyRaw=_raw | mvexpand Astring | eval _raw=Astring | search [|inputlookup searchterms.csv] | table _time, Astring 

View solution in original post

0 Karma

drodman29
Path Finder

Resolved using a _raw rename. 

BaseSearch | eval MyRaw=_raw | mvexpand Astring | eval _raw=Astring | search [|inputlookup searchterms.csv] | table _time, Astring 

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security(ES) 7.3 is approaching the end of support. Get ready for ...

Hi friends!    At Splunk, your product success is our top priority. With Enterprise Security (ES), we're here ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk, and empower your SOC to reach new heights! Duration: 1 hour  Prepare to ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...