Getting Data In

trying to lexically parse a text field and group results into categories

brucejohnson
New Member

I have an xml file with a text field. The text field may include trigger words. I have a list of those trigger words. Obviously I can search for those trigger words from the text field by using wildcards. I don't want to do sub-searches for every possible correlation.

So my description might be "item rejected because expiration date is wrong" or "security violation" or "date of birth missing, application rejected" and my keywords might be "rejected", "expiration", "security", or "violation".

Is there a way to do a lookup using the wildcard by way of substitution? Would you use a regex?

I'd like to be able to group the results by trigger word.

Tags (1)
0 Karma

niketn
Legend

You can parse XML data using either spath or xpath command.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...