topic Excluding a list of IP's from the results in Splunk Search https://community.splunk.com/t5/Splunk-Search/Excluding-a-list-of-IP-s-from-the-results/m-p/451643#M127903 <P>I have a list of IP's in a CSV that I need to exclude from the results of a query. Below is a my query. How can I apply the lookup feature or something else to accomplish this? I would like to include all the destination IP's that I want to exclude in the CSV and display the top ten destination IP's thanks.</P> <P>sourcetype="cisco:sourcefire:appliance:syslog" AccessControlRuleAction=Allow AND NOT DstIP=172.* | top limit=10 DstIP</P> Sun, 03 Feb 2019 00:06:13 GMT samble 2019-02-03T00:06:13Z Excluding a list of IP's from the results https://community.splunk.com/t5/Splunk-Search/Excluding-a-list-of-IP-s-from-the-results/m-p/451643#M127903 <P>I have a list of IP's in a CSV that I need to exclude from the results of a query. Below is a my query. How can I apply the lookup feature or something else to accomplish this? I would like to include all the destination IP's that I want to exclude in the CSV and display the top ten destination IP's thanks.</P> <P>sourcetype="cisco:sourcefire:appliance:syslog" AccessControlRuleAction=Allow AND NOT DstIP=172.* | top limit=10 DstIP</P> Sun, 03 Feb 2019 00:06:13 GMT https://community.splunk.com/t5/Splunk-Search/Excluding-a-list-of-IP-s-from-the-results/m-p/451643#M127903 samble 2019-02-03T00:06:13Z Re: Excluding a list of IP's from the results https://community.splunk.com/t5/Splunk-Search/Excluding-a-list-of-IP-s-from-the-results/m-p/451644#M127904 <P>Assuming your list of excluded IPs is in a lookup file called 'exclude.csv', the query would look something like this:</P> <P>sourcetype="cisco:sourcefire:appliance:syslog" AccessControlRuleAction=Allow NOT [|inputlookup exclude,csv | fields ip | format] | top limit=10 DstIP</P> Sun, 03 Feb 2019 01:12:05 GMT https://community.splunk.com/t5/Splunk-Search/Excluding-a-list-of-IP-s-from-the-results/m-p/451644#M127904 richgalloway 2019-02-03T01:12:05Z Re: Excluding a list of IP's from the results https://community.splunk.com/t5/Splunk-Search/Excluding-a-list-of-IP-s-from-the-results/m-p/451645#M127905 <P>Thanks for your guidance. I had to make a slight change and it worked. It wanted the fields also as DstIP</P> <P>sourcetype="cisco:sourcefire:appliance:syslog" AccessControlRuleAction=Allow NOT [|inputlookup Exclude.csv | fields DstIP | format] | top limit=10 DstIP</P> Sun, 03 Feb 2019 22:52:24 GMT https://community.splunk.com/t5/Splunk-Search/Excluding-a-list-of-IP-s-from-the-results/m-p/451645#M127905 samble 2019-02-03T22:52:24Z