Yours would be like this: | inputlookup Applications. Yours would be like this: | inputlookup Applications.csv | stats values(multifield) AS multifield values(Application) AS Application BY AppNo And in nf: userlookup filename userlookup.csv. So something like this in nf: yoursourcetype LOOKUP-user userlookup user OUTPUT username. | strcat FuncNo ',' Functionality multifield Use the matchtype in nf to specify the field you want to match on as a wildcard, then populate your lookup table just like youve planned to. I still do not get exactly why the lookup is not adequate, but here is another way, without lookup in run-anywhere code: | makeresults Am I doing something incorrectly, or does this really not work?įunctionalities.csv AppNo,FuncNo,Functionalityĭesired output AppNo, Application, FuncNo, Functionality

Trying to read the lowest layer first is weird. The first 1 is much easier to read for anyone who comes after me, especially since I have 2 more input tables to join. Since join and type are dangerously similar to SQL, why does this not behave like SQL? I can only get all 30 rows when i switch the two lookup tables around, which shouldn't matter since it's an inner join. There are many more AppNo field values with a match in both tables, but only 4 are pulled. In this analysis, we explore three such value stocks: Cisco Systems Inc. For the other values, the lookup is working fine. However, the values with double quotes are not getting matched. I have also included quotes in my csv file for those values. Some of the values for that field in my log has double quotes. This will only ever pull 4 total rows, even if Functionalities.csv contains 30 matching AppNo field values. I have created a csv file mapping a field from my raw index to a more readable version. This will pull all 4 rows in Applications.csv, and only 4 rows in Functionalities.csv. To make the logic easy to read, I want the first table to be the one whose data is higher up in hierarchy.

An unexpected character is reached at ')'.I'm trying to join 2 lookup tables. Now there are a few cases where the responseCode in the search does not match to anything in the lookup table. Get-RegAlwaysInstallElevated Get-RegAlwaysInstallElevatedĮrror I get is: Error in 'eval' command: The expression is malformed. That lookup contains the responseCode and its description. Set-MasterBootRecord Set-MasterBootRecord You need a default field value if an event’s value is not in the lookup table. I needed to do this to see what strings were matching my powershell script blocks to weed out high false positive rates, but I keep getting a eval malformed error when I try to example above. The search works perfect as: indexproxysg sourcetypeproxysgbase inputlookup aterms. These unstructured indexed data/logs are only categorised based on different sourcetypes and as you can see in the lookup csv file, each line shows the substring and it's corresponding sourcetype which needs to be searched. Just wondering if there's another method to expedite searching unstructured log files for all the values in my lookup csv file and return the stats/count/etc. As there are huge number of events and quite large number of substrings in the csv file, it takes ages to return the result. I run the above query (returning 'Field-Substring' field) against some index data/events to count the number of occurrences of substrings. In my case, I have a structured data file like this:įield-ID,Field-SourceType,Field-SubstringĢ,sourcetype1,Another other text with WILDCARD * hereģ,sourcetype2,This is a different text for different sourcetype The solution is working fine but it uses a lot of resources when the number of rows in csv file and index size grow.

Splunk lookup not matching