Getting Data In

Is it possible to find values that are wrapped by quotation marks in a lookup table?

AbubakarShahid
New Member

I have a lookup table that has values that are wrapped by quotations. For example: "fw: Help".
If I try to search for this by this search:
|inputlookup zyx.csv | search column="fw: Help" nothing comes up.
I have even tried this as well:
|inputlookup zyx.csv | search column=fw: Help

BUT if i do | search column=* it populates all the value in the lookup table which is fine but i need help finding a value that is wrapped around quotation.
How can i do that?
Is it even possible to search for a value that is wrapped in quotations?

Tags (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi AbubakarShahid,
if you don't want to modify your lookup, you could use regexes at search time to search using " or to not consider " in searches:

| inputlookup zyx.csv 
| rex field=column "\"(?<newcolumn>[^\"]*)\""
| search new column="fw: Help"

Bye.
Giuseppe

View solution in original post

0 Karma

lfedak_splunk
Splunk Employee
Splunk Employee

Hey @AbubakarShahid, if they solved your problem, remember to "√Accept" an answer to award karma points 🙂

0 Karma

niketn
Legend

@AbubakarShahid, please try the following command:

| inputlookup zxy.csv where column="\"fw: Help\""

You would need to escape double quotes in your query using back slash ( \ ).

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi AbubakarShahid,
if you don't want to modify your lookup, you could use regexes at search time to search using " or to not consider " in searches:

| inputlookup zyx.csv 
| rex field=column "\"(?<newcolumn>[^\"]*)\""
| search new column="fw: Help"

Bye.
Giuseppe

0 Karma

AbubakarShahid
New Member

so this good it actually creates a new column and the the value that have quotation to a new column with out quotations.
what i wanted was this below which workds.
so this works if i do this
| inputlookup URL_TEST.csv | rex field=URLTEST "\"(?[^\"])\"" | search URLTEST=
that search will show me all the results.
if i do this
| inputlookup URL_TEST.csv | rex field=URLTEST "\"(?[^\"])\"" | search URLTEST="fw"

it will display "fw: Help"

Thank you so much

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...