https://community.splunk.com/t5/Splunk-Search/How-to-filter-results-using-fields-from-lookup-file/m-p/381119#M111498 <P>How's this?</P> <PRE><CODE> index=foo sourcetype=bar NOT [|inputlookup foobar |table ip,dnsName] | dedup ip dnsName </CODE></PRE> Wed, 10 Jul 2019 04:28:26 GMT HiroshiSatoh 2019-07-10T04:28:26Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-results-using-fields-from-lookup-file/m-p/381116#M111495 <P>I have a challenge in front of me that I can't figure out. I spent a few hours searching 'answers' and made some headway but I need some help on a sticking point...</P> <P>The problem: We need to be able to quantify "new" hosts that are found on our network every 30 days. To do this I have connected Splunk with Tenable SecurityCenter (using the add-on) to feed Splunk all the data we need to solve this problem. </P> <P>The solution: I have created two searches. </P> <P>1) The first search creates the lookup file that contains the previously discovered IP addresses and hostnames (outputlookup append=t). The time range for this scan is -90d@d to -31d@d</P> <P>2) The second search is where I have run into a problem. The second search should take the lookup table created in the first search, compare the fields containing the IP and hostname data and if it finds a match exclude it from the search results. The time range of this search is -30d@d to now. This should result in only "new" hosts or hosts found in the most recent scan. </P> <P>The second search is:</P> <PRE><CODE>index=foo sourcetype=bar | dedup ip dnsName | rename ip as IP dnsName as Hostname | lookup foobar ip OUTPUT ip | search NOT (ip or dnsName) </CODE></PRE> <P>This gets me halfway there, but I really need to exclude both ip and dnsName. How do add a second "output" to the lookup command? If I simply put it directly after the first I get an error. </P> Mon, 08 Jul 2019 16:42:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-results-using-fields-from-lookup-file/m-p/381116#M111495 chrisray_view 2019-07-08T16:42:06Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-results-using-fields-from-lookup-file/m-p/381117#M111496 <P>What error do you get when you try <CODE>... | lookup foobar ip OUTPUT ip dnsname | ...</CODE> ?</P> Mon, 08 Jul 2019 17:54:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-results-using-fields-from-lookup-file/m-p/381117#M111496 richgalloway 2019-07-08T17:54:34Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-results-using-fields-from-lookup-file/m-p/381118#M111497 <P>When I did that...I didn't get an error. </P> <P>I have however restructured the search:</P> <P>' index=foo sourcetype=bar | dedup ip dnsName | lookup foobar ip dnsName OUTPUT ip dnsName | search NOT (ip OR dnsName) | table ip dnsName'</P> <P>This appears to be working as I need it to, but I need to verify the output is correct (working on that). </P> Tue, 09 Jul 2019 17:21:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-results-using-fields-from-lookup-file/m-p/381118#M111497 chrisray_view 2019-07-09T17:21:00Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-results-using-fields-from-lookup-file/m-p/381119#M111498 <P>How's this?</P> <PRE><CODE> index=foo sourcetype=bar NOT [|inputlookup foobar |table ip,dnsName] | dedup ip dnsName </CODE></PRE> Wed, 10 Jul 2019 04:28:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-results-using-fields-from-lookup-file/m-p/381119#M111498 HiroshiSatoh 2019-07-10T04:28:26Z