topic Re: How do I return values that unmatched column in Lookup table? in Splunk Search

How do I return values that unmatched column in Lookup table?

sabeqa — Thu, 06 Sep 2018 08:43:21 GMT

i am trying to search for urls that are not in my allowed list lookup csv , my csv file is named as url and has 1 column with a header called hostname, below is the search which gives a wrong output.

fgt_webfilter profile=* status=passthrough NOT [ inputlookup url ]

Re: How do I return values that unmatched column in Lookup table?

harsmarvania57 — Thu, 06 Sep 2018 11:53:45 GMT

Hi @sabeqa,

Try this one fgt_webfilter profile=* status=passthrough NOT [ | inputlookup url | format ]

Re: How do I return values that unmatched column in Lookup table?

richgalloway — Thu, 06 Sep 2018 11:57:49 GMT

Try this.

`fgt_webfilter` profile=* status=passthrough NOT [  | inputlookup url | format ]

Re: How do I return values that unmatched column in Lookup table?

sabeqa — Thu, 06 Sep 2018 13:01:22 GMT

now i am getting an output but includes some wrong results, (urls in the csv are still appearing)