Exclude from search values from lookup table

braicu — Tue, 29 Sep 2020 23:52:30 GMT

Hello,

I have a lookup table which i test it like this :
|inputlookup approved_s3_buckets.csv

and display the column :
Bucket-Name
bucketname1
bucketname2
.....
bucketname50

And i have a search which display me :
Bucket-Name
bucketname1
bucketname2
bucketname3
bucketname100
buketname535353

I want to exclude from my search, the values of bucket names which are present into the lookup table approved_s3_buckets.csv .
(Something similar with Bucket-Name!=bucketname1 AND Bucket-Name!=bucketname2.... and so on)

Re: Exclude from search values from lookup table

adonio — Wed, 27 Mar 2019 00:39:59 GMT

hello there

try this out:
... your search ... NOT [ |inputlookup approved_s3_buckets.csv | fields approved_s3_buckets.csv | dedup approved_s3_buckets.csv | table approved_s3_buckets.csv]

for practice, try the following searches:
first, create a small fruit basket lookup:

| makeresults count=1
| eval fruits = "apple,banana,orange,lemon"
| makemv delim="," fruits
| mvexpand fruits
| outputlookup fruits.csv

then check its there:

| inputlookup fruits.csv

then add 2 extra fruits to the basket and verify they arent there:

| makeresults count=1
| eval fruits = "apple,banana,orange,lemon,melon,watermelon"
| makemv delim="," fruits
| mvexpand fruits
| search fruits = * NOT [| inputlookup fruits.csv | fields fruits | dedup fruits | table fruits ]

hope it helps

topic Exclude from search values from lookup table in Splunk Search

Exclude from search values from lookup table

Re: Exclude from search values from lookup table