I have a CSV file in which I have a column containing timestamps and a column containing text. I want to be albe to look for occurrences of certain keywords (let's say 10 keywords) and to show the number of occurrences of each keyword on a chart. It would also be good to find a display them over time. What I do not understand is how to search for multiple keywords on this strings while counting the occurrences... can you help me?
Example file (where timestamp represent the day):
TIMESTAMP;TEXT_STRING
20;The quick brown fox jumps over the lazy dog
Assuming that you have a csv file with headers (e.g. timestamp
and string
), you could use the inputlookup
feature to load the file as search results.
| inputlookup file.csv
| rex field=string "(?<word>\S+)" max_match=0
| mvexpand word
| table timestamp word
| search word=xxx OR word=yyy OR word=zzz
| top 10 word
Add more words in the 'search' statement above. The last statement can be changed for
| chart count over timestamp by word
There are probably more than one way to do this, and probably more efficient than this.
/K
Assuming that you have a csv file with headers (e.g. timestamp
and string
), you could use the inputlookup
feature to load the file as search results.
| inputlookup file.csv
| rex field=string "(?<word>\S+)" max_match=0
| mvexpand word
| table timestamp word
| search word=xxx OR word=yyy OR word=zzz
| top 10 word
Add more words in the 'search' statement above. The last statement can be changed for
| chart count over timestamp by word
There are probably more than one way to do this, and probably more efficient than this.
/K
Thanks, this helps a lot.