https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-exclude-search-results-with-two-lookup-files/m-p/486192#M136033 <P>Thank you for helping me. I see. I need search command. Thank you so much!!</P> Fri, 27 Sep 2019 05:41:29 GMT subachu 2019-09-27T05:41:29Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-exclude-search-results-with-two-lookup-files/m-p/486189#M136030 <P>Hi,all</P> <P>I'm sorry but I use lookup for the first time.<BR /> Is it possible to exclude search results with two lookup files?</P> <P>Create a host name lookup file. (HOST.csv)<BR /> Create a lookup file for the service name. (NAME.csv)</P> <P>First, exclude the hostname first.</P> <PRE><CODE>index = main source = host NOT [| inputlookup HOST.csv] </CODE></PRE> <P>What type of search statement would you like to exclude further service names from this search result?</P> <P>I thought like this.</P> <PRE><CODE>(index = main source = host NOT [| inputlookup HOST.csv]) NOT [inputlookup NAME.csv] </CODE></PRE> <P>Could you help me?</P> Thu, 26 Sep 2019 01:06:03 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-exclude-search-results-with-two-lookup-files/m-p/486189#M136030 subachu 2019-09-26T01:06:03Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-exclude-search-results-with-two-lookup-files/m-p/486190#M136031 <P>I noticed that your second <CODE>inputlookup</CODE> did not have a pipe. You might want to try doing 2 pipes of <CODE>search</CODE> such as</P> <PRE><CODE>index=main | search NOT [|inputlookup HOST.csv] | search NOT [|inputlookup NAME.csv] </CODE></PRE> Thu, 26 Sep 2019 01:41:51 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-exclude-search-results-with-two-lookup-files/m-p/486190#M136031 morethanyell 2019-09-26T01:41:51Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-exclude-search-results-with-two-lookup-files/m-p/486191#M136032 <P>Try this!</P> <PRE><CODE> index = main source = host NOT [| inputlookup HOST.csv] NOT [| inputlookup NAME.csv] ↓ index=main source=host NOT ( host=X OR host=y OR host=Z ) AND NOT (name=X OR name=y OR name=Z) </CODE></PRE> Thu, 26 Sep 2019 02:20:32 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-exclude-search-results-with-two-lookup-files/m-p/486191#M136032 HiroshiSatoh 2019-09-26T02:20:32Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-exclude-search-results-with-two-lookup-files/m-p/486192#M136033 <P>Thank you for helping me. I see. I need search command. Thank you so much!!</P> Fri, 27 Sep 2019 05:41:29 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-exclude-search-results-with-two-lookup-files/m-p/486192#M136033 subachu 2019-09-27T05:41:29Z