If I have a search result which has a field named "Field1" and It has values like :
This is Word1 now.
This is Word2 now.
This is WordX now.
This is WordZ now.
Below is the lookup table for Words.
Field1
Word1
Word2
Word3
Word4
Word5
Word6
How can I search so I get ONLY below results in the output because they contain "Word1" and "Word2" which are in the lookup table?
This is Word1 now.
This is Word2 now.
One way is to read the lookup file in a subsearch.
index=foo [ | inputlookup words.csv | format ]
The format
command puts the contents of the lookup file into field=value format so the final query becomes index=foo ((field1=Word1) OR (field1=Word2))
.
The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.