https://community.splunk.com/t5/Splunk-Search/How-to-filter-specfic-result/m-p/562108#M195489 <P>In my search result, I have the "Description" field.<BR />The Description field contains both texts and 2 IP details.<BR />I want to check both IPs with my lookup table.<BR />If the IPs are not present in the lookup then I need the result.&nbsp;&nbsp;If the IPs are present in my lookup table then I want to filter the result.</P> <P>&nbsp;</P> <P>Kindly help here.</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="alexspunkshell_0-1628093699803.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/15431i211DC1968779B3AA/image-size/medium?v=v2&amp;px=400" role="button" title="alexspunkshell_0-1628093699803.png" alt="alexspunkshell_0-1628093699803.png" /></span></P> <P>&nbsp;</P> Wed, 04 Aug 2021 19:21:20 GMT alexspunkshell 2021-08-04T19:21:20Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-specfic-result/m-p/562108#M195489 <P>In my search result, I have the "Description" field.<BR />The Description field contains both texts and 2 IP details.<BR />I want to check both IPs with my lookup table.<BR />If the IPs are not present in the lookup then I need the result.&nbsp;&nbsp;If the IPs are present in my lookup table then I want to filter the result.</P> <P>&nbsp;</P> <P>Kindly help here.</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="alexspunkshell_0-1628093699803.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/15431i211DC1968779B3AA/image-size/medium?v=v2&amp;px=400" role="button" title="alexspunkshell_0-1628093699803.png" alt="alexspunkshell_0-1628093699803.png" /></span></P> <P>&nbsp;</P> Wed, 04 Aug 2021 19:21:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-specfic-result/m-p/562108#M195489 alexspunkshell 2021-08-04T19:21:20Z https://community.splunk.com/t5/Splunk-Search/How-to-filter-specfic-result/m-p/562120#M195490 <P>hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/126376">@alexspunkshell</a>,&nbsp;<BR />Use rex to extract IPs and lookup IPs in the lookup table.<BR /><BR /></P><LI-CODE lang="markup">| rex field=Description max_match=0 "(?&lt;IP&gt;\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | lookup lookup_table lookup_table_IP_field AS IP OUTPUT lookup_table_IP_field as new_field | where mvcount(IP)=mvcount(new_field)</LI-CODE><P>&nbsp;</P><P>If this reply helps you, a like would be appreciated.</P> Wed, 04 Aug 2021 18:11:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-filter-specfic-result/m-p/562120#M195490 manjunathmeti 2021-08-04T18:11:41Z