https://community.splunk.com/t5/Getting-Data-In/How-to-exclude-Host-using-Inputlookup/m-p/355456#M64972 <P>Change the subsearch to output only the server name for the servers with status N, and rename the field name to whatever the field will be called on the other index...</P> <PRE><CODE>[|inputlookup serverBP.csv | where Status=="N"| table Servers | rename Servers as host] </CODE></PRE> <P>You can see what the output of the implicit format command will be -- that is, what will be returned by the square brackets -- by running the search independently, and piping it to the explicit format command....</P> <PRE><CODE> |inputlookup serverBP.csv | where Status=="N"| table Servers | rename Servers as host | format </CODE></PRE> <P>...which in this case will probably look like... </P> <PRE><CODE>(host="server3") </CODE></PRE> Fri, 16 Jun 2017 11:21:05 GMT DalJeanis 2017-06-16T11:21:05Z https://community.splunk.com/t5/Getting-Data-In/How-to-exclude-Host-using-Inputlookup/m-p/355455#M64971 <P>index=bp_prod NOT ([|inputlookup serverBP.csv|fields Servers Status |where Status=="N"] ) |eventstats count as "totalCount" | eventstats count as "choiceCount" by host| eval percent=(choiceCount/totalCount)*100 | stats values(choiceCount) as Count , values(percent) as Percentage by host</P> <P>In my serverBP.csv i have following coloumn:</P> <P>Servers Status</P> <P>server1 Y<BR /> server2 Y<BR /> server3 N</P> <P>I have to exclude server 3 in my query </P> Fri, 16 Jun 2017 07:16:09 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-exclude-Host-using-Inputlookup/m-p/355455#M64971 karthi2809 2017-06-16T07:16:09Z https://community.splunk.com/t5/Getting-Data-In/How-to-exclude-Host-using-Inputlookup/m-p/355456#M64972 <P>Change the subsearch to output only the server name for the servers with status N, and rename the field name to whatever the field will be called on the other index...</P> <PRE><CODE>[|inputlookup serverBP.csv | where Status=="N"| table Servers | rename Servers as host] </CODE></PRE> <P>You can see what the output of the implicit format command will be -- that is, what will be returned by the square brackets -- by running the search independently, and piping it to the explicit format command....</P> <PRE><CODE> |inputlookup serverBP.csv | where Status=="N"| table Servers | rename Servers as host | format </CODE></PRE> <P>...which in this case will probably look like... </P> <PRE><CODE>(host="server3") </CODE></PRE> Fri, 16 Jun 2017 11:21:05 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-exclude-Host-using-Inputlookup/m-p/355456#M64972 DalJeanis 2017-06-16T11:21:05Z