https://community.splunk.com/t5/Splunk-Search/How-can-I-search-for-the-alerts-usecase/m-p/643816#M223031 <P><BR />Hi, Need a search for the below usecase&nbsp;<BR /><BR />Search for alert_type=ufa and alert_name="&nbsp; suspicious&nbsp; Downloads"<BR />Please include all&nbsp; domains present in the domains.csv&nbsp; from&nbsp; this search&nbsp;<BR /><BR />We are looking for users that trigger the one above AND this one:</P> <P>Search for alert_type=ufa and alert_name=" suspicious&nbsp; uploads"<BR />Please exclude all domains present in the domains.csv&nbsp; from this search<BR />Thanks...<BR /><BR />Thanks...</P> Thu, 18 May 2023 18:26:06 GMT AL3Z 2023-05-18T18:26:06Z https://community.splunk.com/t5/Splunk-Search/How-can-I-search-for-the-alerts-usecase/m-p/643816#M223031 <P><BR />Hi, Need a search for the below usecase&nbsp;<BR /><BR />Search for alert_type=ufa and alert_name="&nbsp; suspicious&nbsp; Downloads"<BR />Please include all&nbsp; domains present in the domains.csv&nbsp; from&nbsp; this search&nbsp;<BR /><BR />We are looking for users that trigger the one above AND this one:</P> <P>Search for alert_type=ufa and alert_name=" suspicious&nbsp; uploads"<BR />Please exclude all domains present in the domains.csv&nbsp; from this search<BR />Thanks...<BR /><BR />Thanks...</P> Thu, 18 May 2023 18:26:06 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-search-for-the-alerts-usecase/m-p/643816#M223031 AL3Z 2023-05-18T18:26:06Z https://community.splunk.com/t5/Splunk-Search/How-can-I-search-for-the-alerts-usecase/m-p/643820#M223033 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/252275">@AL3Z</a>,</P><P>You didn't provide field names in the events and lookup file. I assume domains.csv is a lookup file in Splunk. Please try below sample; I assumed your event and csv file has a field named "domain"</P><LI-CODE lang="markup">alert_type=ufa and alert_name="suspicious uploads" NOT [inputlookup domains.csv | fields domain | format]</LI-CODE><P>&nbsp;</P> Thu, 18 May 2023 18:42:25 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-search-for-the-alerts-usecase/m-p/643820#M223033 scelikok 2023-05-18T18:42:25Z