topic Re: Using a csv lookup to exclude results from a query, but not working if more than one column of fields in Getting Data In

Using a csv lookup to exclude results from a query, but not working if more than one column of fields

sknot1454 — Wed, 10 Aug 2016 21:30:42 GMT

I have a lookup table that I want to use to exclude results from a search. I want to exclude results if something in Field A matches OR something matches in Field B.

Field A|Field B
Data|Data

If I only use one column in the CSV(column with Field A) and run it with my query: "sourcetype=bla | search NOT [inputlookup blahlookup]", the data I want excluded from field A is excluded. If include both columns in my lookup, it won't exclude any results.

Is this possible or will I have to make up a separate lookup table for Field B and use an OR statement in my query?

Re: Using a csv lookup to exclude results from a query, but not working if more than one column of fields

sundareshr — Wed, 10 Aug 2016 22:43:04 GMT

See similar question answered here

https://answers.splunk.com/answers/129068/using-lookup-tables-to-exclude-timerange-from-search.html

Re: Using a csv lookup to exclude results from a query, but not working if more than one column of fields

sknot1454 — Thu, 11 Aug 2016 02:05:33 GMT

That eval definitely looks promising. Thanks!

Re: Using a csv lookup to exclude results from a query, but not working if more than one column of fields

sundareshr — Thu, 11 Aug 2016 19:46:54 GMT

If this works, please mark this answer as accepted to close it out.