topic Re: inputlookup excluding index in Splunk Search

inputlookup excluding index

jmo1 — Tue, 26 Jan 2021 20:40:28 GMT

I am trying to write a query that will ignore events in certain indexes (these indexes change over time). I have a CSV file with a single column that looks like this...

Index

NOTE: this is a simple example, it really has 25+ indexes

host=* NOT index=[| inputlookup Index.csv | fields Index]

This is my non-working attempt. The actual query is irrelevant (host=*), the point is that I want to ignore any hits where the index is in the CSV file (index!=a index!=b index!=c).

Any help would be greatly appreciated.

Re: inputlookup excluding index

bowesmana — Tue, 26 Jan 2021 21:32:17 GMT

You don't need the index=... and case is important, so use this

host=* NOT [ | inputlookup indexes.csv | rename Index as index ]

Note the rename, as your column is Index, not index, so either change the column name in the table and just use | table index or go with the above

Re: inputlookup excluding index

jmo1 — Wed, 27 Jan 2021 13:45:44 GMT

Thank you! It is working.