topic Re: How can I remove entries from an existing lookup table? in Splunk Search

How can I remove entries from an existing lookup table?

ddrillic — Wed, 24 Oct 2018 19:09:31 GMT

I have a lookup table from which I need to remove a couple of lines. How can I do it?

Re: How can I remove entries from an existing lookup table?

niketn — Wed, 24 Oct 2018 19:14:31 GMT

@ddrillic are you looking for inputlookup --> Filter Unwanted Results --> outputlookup?

Re: How can I remove entries from an existing lookup table?

ddrillic — Wed, 24 Oct 2018 19:20:27 GMT

Right @niketnilay ; -) this one did it - | inputlookup <lookup name> | search host != host* | outputlookup <lookup name>

Based on How to remove a row from lookup table and update it?

@niketnilay - please convert to an answer.

Re: How can I remove entries from an existing lookup table?

manjunath_n — Mon, 18 Apr 2022 19:24:27 GMT

Have a similar requirement.

| inputlookup <lookup name> | search host != host* | outputlookup <lookup name>

We want to remove a guid record or line containing the guid from the lookup table so we should filter using = or != ?

| inputlookup abc | search guid= 123456 | outputlookup abc, when tried with this ended up in updating only this record for the entire lookup , so ideally the query should be | inputlookup abc | search guid!= 123456 | outputlookup abc right? please clarify on the filtering of the result @ddrillic @niketn Thanks!