简体   繁体   中英

Splunk - How to get results only if search field contains a word in the lookup table

If I have a search result which has a field named "Field1" and It has values like :

This is Word1 now.

This is Word2 now.

This is WordX now.

This is WordZ now.

Below is the lookup table for Words.

Field1

Word1

Word2

Word3

Word4

Word5

Word6

How can I search so I get ONLY below results in the output because they contain "Word1" and "Word2" which are in the lookup table?

This is Word1 now.

This is Word2 now.

One way is to read the lookup file in a subsearch.

index=foo [ | inputlookup words.csv | format ]

The format command puts the contents of the lookup file into field=value format so the final query becomes index=foo ((field1=Word1) OR (field1=Word2)) .

The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.

 
粤ICP备18138465号  © 2020-2024 STACKOOM.COM