https://community.splunk.com/t5/Getting-Data-In/How-to-reference-csv-subsearch-results-to-exclude-matching/m-p/133357#M27407 <P>Hello Splunkers,<BR /> I am successfully searching two indexes from two separate .csv files. Both indexes contain a 'similar' set of hostnames. I am searching index A for a particular list of hostnames that I would like to reference so that I can exclude any matching hostnames from index B. Anything with the field where Purpose2 has the word 'farm' in it needs to be excluded from both lists.<BR /> I will eventually be joining the hostnames lists between indexes as one single master list but I need to exclude the list from Index A from both.</P> <P>Here is the search that identifies the list of hostnames from index A:</P> <PRE><CODE>index=asset_db source="/var/asset_database/fullpull.csv" "Reporting Status"=Reporting "High Level Status"=Production "System Name"=* "Purpose2"=*Farm* | rename "System Name" AS hostname </CODE></PRE> <P>search for index B which successfully returns a list of hostnames:</P> <PRE><CODE>index=test_assets source="C:\\Splunk Test Assets\\AD-LDAP export.csv" earliest=-90d@d latest=-0d@d CN=* | rename CN as hostname </CODE></PRE> <P>How do I get index B search to "see" and exclude the search from index A?</P> <P>Thank you very much for any assistance.</P> Fri, 19 Sep 2014 20:02:05 GMT lbogle 2014-09-19T20:02:05Z https://community.splunk.com/t5/Getting-Data-In/How-to-reference-csv-subsearch-results-to-exclude-matching/m-p/133357#M27407 <P>Hello Splunkers,<BR /> I am successfully searching two indexes from two separate .csv files. Both indexes contain a 'similar' set of hostnames. I am searching index A for a particular list of hostnames that I would like to reference so that I can exclude any matching hostnames from index B. Anything with the field where Purpose2 has the word 'farm' in it needs to be excluded from both lists.<BR /> I will eventually be joining the hostnames lists between indexes as one single master list but I need to exclude the list from Index A from both.</P> <P>Here is the search that identifies the list of hostnames from index A:</P> <PRE><CODE>index=asset_db source="/var/asset_database/fullpull.csv" "Reporting Status"=Reporting "High Level Status"=Production "System Name"=* "Purpose2"=*Farm* | rename "System Name" AS hostname </CODE></PRE> <P>search for index B which successfully returns a list of hostnames:</P> <PRE><CODE>index=test_assets source="C:\\Splunk Test Assets\\AD-LDAP export.csv" earliest=-90d@d latest=-0d@d CN=* | rename CN as hostname </CODE></PRE> <P>How do I get index B search to "see" and exclude the search from index A?</P> <P>Thank you very much for any assistance.</P> Fri, 19 Sep 2014 20:02:05 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-reference-csv-subsearch-results-to-exclude-matching/m-p/133357#M27407 lbogle 2014-09-19T20:02:05Z https://community.splunk.com/t5/Getting-Data-In/How-to-reference-csv-subsearch-results-to-exclude-matching/m-p/133358#M27408 <P>Try this</P> <PRE><CODE> index=test_assets source="C:\\Splunk Test Assets\\AD-LDAP export.csv" earliest=-90d@d latest=-0d@d CN=* NOT [search index=asset_db source="/var/asset_database/fullpull.csv" "Reporting Status"=Reporting "High Level Status"=Production "System Name"=* "Purpose2"=*Farm* | rename "System Name" AS CN| table CN]| rename CN as hostname </CODE></PRE> Fri, 19 Sep 2014 20:10:02 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-reference-csv-subsearch-results-to-exclude-matching/m-p/133358#M27408 somesoni2 2014-09-19T20:10:02Z https://community.splunk.com/t5/Getting-Data-In/How-to-reference-csv-subsearch-results-to-exclude-matching/m-p/133359#M27409 <P>I think that did it! Thanks!</P> Tue, 23 Sep 2014 00:35:03 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-reference-csv-subsearch-results-to-exclude-matching/m-p/133359#M27409 lbogle 2014-09-23T00:35:03Z