Hello all,
I am trying to figure out how to save the results from a search and then check if they exist in my lookup table. I've tried a bunch of things, but don't seem to get the correct results back. What I am doing is running a search using a regex to save to a fieldname called searchString. The field returns about 1200 items when I run |table searchString
. I want to use the data stored in the fieldName searchString and then see if there's a match for that string in my lookup file. When I use eval and set a known string to test the search below, it works fine and I get a match. When I use the same search, but instead of using eval to set the searchString, I don't get anything back. Not sure what I am doing wrong, any help would be greatly appreciated.
This works for testing:
| stats count | fields - count | eval searchString="testString123test" | lookup masterStringList.csv strings
This one does not work when using it as part of a search result although I testString123test was added and should match.
searchHere | dedup searchString | stats count | fields - count | lookup masterStringList.csv string
Try something like this
your base search | stats count by searchString | fields - count | lookup masterStringList.csv lookupFileFieldname as searchString
This gets me a little closer, however the query seems to print every single record in the lookupFile and add if a match is found it populates an additional column with the headers from the lookupfile. Is there a way to just show matches and not everything in the lookupFile?