Database Reference
In-Depth Information
vertising words associated with coffee. Let's call the .csv file
filtered_words.csv
,
and give it just a single text field, containing words like "is", "the", and "then". Let's re-
write the search to look like the following code:
index=twitter text=*coffee*
| makemv text | mvexpand text
| search NOT [inputlookup filtered_words | fields text ]
| top 30 text
Using the preceding code, Splunk will search our Twitter index for
*coffee*
, and then
expand the text field so that individual words are separated out. Then it will look for
words that do NOT match any of the words in our
filtered_words.csv
file, and fi-
nally output the top 30 most frequently found words among those.
As you can see, the lookup table can be very useful. To learn more about Splunk lookup
