Boolean query to exclude value in Filter Lookup

mojoes — Mon, 11 Dec 2023 12:06:54 GMT

Hi, I am new at Splunk and I'm following the lab in Enriching Data with Lookups, where I'm requested to exclude a value using the Flter Lookup. I have a Lookup definition based on knonwusers.csv

In the video it doesn't explain or show any example for this specific field. I have tried the following:

user NOT (root OR mail OR apache)
user <> (root OR mail OR apache)
|inputlookup knownusers.csv |eval user NOT (root OR mail OR apache)

And nothing is working. Could you please tell me what am I doing wrong?

Re: Boolean query to exclude value in Filter Lookup

ITWhisperer — Mon, 11 Dec 2023 12:52:53 GMT

You could do something like this

| inputlookup knownusers.csv | where NOT user IN ("root", "mail", "apache")

Although this might not be classed a filtering using a lookup.

Assuming you have a user field in your events, you could filter them like this

| lookup knownusers.csv user OUTPUT user AS found_user | where isnull(found_user)

topic Re: Boolean query to exclude value in Filter Lookup in Splunk Search

Boolean query to exclude value in Filter Lookup

Re: Boolean query to exclude value in Filter Lookup