topic Re: spl query in Getting Data In

Filter using a lookup.

aly347774 — Mon, 29 Jan 2024 11:59:04 GMT

I want to write a query whose purpose is to print for users who are not authorized to enter, and of course with the presence of a lookup table, the people who are authorized to enter are present in it.

Re: spl query

ITWhisperer — Sun, 28 Jan 2024 14:33:09 GMT

Please share some anonymised sample events to show what you are working with

Re: spl query

aly347774 — Mon, 29 Jan 2024 06:14:26 GMT

index="(index name)" sourcetype=source type (host="host1" OR host="host2")
| search NOT [| inputlookup (lookup table name ) | table username] action=success | stats values(username) as user

Re: spl query

ITWhisperer — Mon, 29 Jan 2024 09:35:18 GMT

OK it looks like it should work - what is your question?

Re: spl query

aly347774 — Mon, 29 Jan 2024 09:46:12 GMT

It does not retrieve the blacklist, but rather it retrieves some of the whitelist. I want to make it pass through the lookuptable and show the user who is not authorized to enter.

Re: spl query

ITWhisperer — Mon, 29 Jan 2024 09:57:51 GMT

The principle of what you are doing is correct. So, if it is not working, it may come down to the actually data, which understandably you might not want to share. How are the values which are getting through different to the ones which are being removed? How large is your lookup table? Are there any special characters being used?