topic Re: i want to discard users that start with a urn:forms:anonymous# in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-discard-users-that-start-with-a-urn-forms-anonymous/m-p/648329#M224344 <P>You could try to add a filter in your lookup definition.</P><P>Assuming the field/column in your csv file that contains the users is called "user":</P><P>Open the lookup definition, check Advanced options, add</P><LI-CODE lang="markup">user!="urn:forms:anonymous#*"</LI-CODE><P>under Filter lookup.</P> Tue, 27 Jun 2023 08:15:12 GMT SplunkyTUM 2023-06-27T08:15:12Z How to discard users that start with a urn:forms:anonymous#? https://community.splunk.com/t5/Splunk-Search/How-to-discard-users-that-start-with-a-urn-forms-anonymous/m-p/648275#M224324 <P>I have some users that start with&nbsp;<STRONG>urn:forms:anonymous# in my lookup<BR /></STRONG>I was trying to to discard them use&nbsp;<STRONG>urn:forms:anonymous#*</STRONG></P> <P>&nbsp;i guess i have to use regex to bring al the users to start like this&nbsp;<STRONG>urn:forms:anonymous#</STRONG><BR /><BR /></P> Tue, 27 Jun 2023 14:57:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-discard-users-that-start-with-a-urn-forms-anonymous/m-p/648275#M224324 Netza 2023-06-27T14:57:26Z Re: i want to discard users that start with a urn:forms:anonymous# https://community.splunk.com/t5/Splunk-Search/How-to-discard-users-that-start-with-a-urn-forms-anonymous/m-p/648285#M224329 <P>Hi</P><P>here is one example how you could do it&nbsp;<A href="https://community.splunk.com/t5/Splunk-Search/Where-to-find-unmatched-regex-events/m-p/440340" target="_blank">https://community.splunk.com/t5/Splunk-Search/Where-to-find-unmatched-regex-events/m-p/440340</A>. If you are not needing those on your lookup, then create it without those.</P><P>r. Ismo</P> Tue, 27 Jun 2023 05:31:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-discard-users-that-start-with-a-urn-forms-anonymous/m-p/648285#M224329 isoutamo 2023-06-27T05:31:17Z Re: i want to discard users that start with a urn:forms:anonymous# https://community.splunk.com/t5/Splunk-Search/How-to-discard-users-that-start-with-a-urn-forms-anonymous/m-p/648329#M224344 <P>You could try to add a filter in your lookup definition.</P><P>Assuming the field/column in your csv file that contains the users is called "user":</P><P>Open the lookup definition, check Advanced options, add</P><LI-CODE lang="markup">user!="urn:forms:anonymous#*"</LI-CODE><P>under Filter lookup.</P> Tue, 27 Jun 2023 08:15:12 GMT https://community.splunk.com/t5/Splunk-Search/How-to-discard-users-that-start-with-a-urn-forms-anonymous/m-p/648329#M224344 SplunkyTUM 2023-06-27T08:15:12Z