How to return values from lookup which are not matching the search?

kavyadekkata — Wed, 30 Sep 2020 00:51:12 GMT

Hi
I currently have a search which returns a list of users with employee id from a user lookup

eg: user lookup has the following information
syyyyyy
sxxxxxx
szzzzzz

My initial search returns syyyyy, sxxxxx but I want the search to return szzzzzz. But my below search is not returning any results

*index=idx_xxxxx sourcetype="cisco:xxx" svc | rename user as identity
| lookup local=true wfh_names_def identity OUTPUT identity, name
| search identity NOT
[| lookup local=true wfh_names_def identity OUTPUT identity, name] *

Could anyone please help

Thanks & Regards
Kavya Dekkata

Re: How to return values from lookup which are not matching the search?

denzelchung — Wed, 12 Jun 2019 06:51:08 GMT

Do the lookup first, then use join to combine your search results with the base lookup values.

For example,

| inputlookup host.csv | join type=left host [metadata type=hosts]

Doing an individual "| metadata type=hosts" search would give me host "A" and "B". In my csv file, I have "A", "B", "C", "D". Doing the above query would give me everything in my lookup file.

topic How to return values from lookup which are not matching the search? in Splunk Search

How to return values from lookup which are not matching the search?

Re: How to return values from lookup which are not matching the search?