How do I make a Splunk query which would exclude hosts which are in a CSV lookup table?

kannu — Thu, 20 Sep 2018 18:59:16 GMT

Hello splunkers ,

I need help with one query. I have all hosts coming in a query when i run index=* and i have some other hosts in a CSV file which i have loaded static using lookups.

I want to run index=* again but I don't want the hosts which are there in CSV to show up in my query.

In short, during search time, i want to exclude all hosts which are there in CSV static file lookup .

I am guessing that join command would work but don't know how can i use .

Please help

Re: How do I make a Splunk query which would exclude hosts which are in a CSV lookup table?

renjith_nair — Fri, 21 Sep 2018 04:04:36 GMT

@kannu ,
Try

index="your index"  NOT [|inputlookup yourcsvfile]

topic How do I make a Splunk query which would exclude hosts which are in a CSV lookup table? in Getting Data In

How do I make a Splunk query which would exclude hosts which are in a CSV lookup table?

Re: How do I make a Splunk query which would exclude hosts which are in a CSV lookup table?