Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Having some trouble with sub searches and makemv/mvexpand

$
0
0
Im trying to do some data mining on twitter for a project. I trying to find keywords that are most popular, and then remove the stop words using a CSV lookup. Here is my query: index=football-twitter lang=en earliest=-15m@m latest=@m | eval foo=text | makemv foo | mvexpand foo | search foo NOT [ | inputlookup StopWords.csv | rename Words AS foo ] | top foo limit=1 | table foo This does not work. but if I use a slightly different query, it works. index=football-twitter lang=en earliest=-15m@m latest=@m | makemv text | mvexpand text | search text NOT [ | inputlookup StopWords.csv | rename Words AS text ] | top text limit=1 | table text What I want to do, is create a time chart of the usage of the top keyword, and also use the sentiment app to generate a sentiment time chart . Something like - index=football-twitter lang=en [search index=football-twitter lang=en earliest=-15m@m latest=@m | makemv text | mvexpand text | search text NOT [ | inputlookup StopWords.csv | rename Words AS text ] | top text limit=1 | table text] | sentiment twitter text | timechart avg(sentiment) but the query above does not seem to work either. Any help would be greatly appreciated. Thanks!

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>