I am looking for something like this as below
I have a seach string = rubi
and want to check this string presence in a lookuptable = metals.csv
Name date region
rubi 12122021 abc
diamond 12122022 def
platinum 12122023 ghi
what would be my splunk query to shows the presence of my search string with lookuptable.
I want the result to be something like below
Since in above example rubi is present in metals.csv my result table should look like with an extra column Present and status as Yes
Name Present
rubi Yes
If not present say example searchstring=copper and is not present in metals.csv then output table should be
Name Present
copper No
Note: I am giving the seachstring in text box of dashboard and want a result table as above
| eval Name="rubi"
| lookup metals.csv
| eval Present=if(isnull(region),"No","Yes")