topic Exclude Events Based on a Lookup in Splunk Search

Exclude Events Based on a Lookup

paddy3883 — Wed, 13 Feb 2013 17:08:39 GMT

I've written a query to find certain events in Splunk and I want to exclude any which match up with a set of values in a CSV lookup. For example for this query:

Type!=Information (*Example1* OR *Example2* OR "*Example with spaces*") earliest=-4h latest=-1m

And I've a CSV with the following values

ExcludeText

Test1

Test2
Test3

I want to exclude any events which contain the text in the CSV file. I've tried this but it doesn't filter them out:

Type!=Information (*\Example1* OR *Example2* OR "*Example with spaces*") earliest=-4h latest=-1m
[| inputlookup exclude_csv | fields ExcludeText]

Any ideas?

Re: Exclude Events Based on a Lookup

Kate_Lawrence-G — Wed, 13 Feb 2013 19:50:53 GMT

When I do this I just something like:

host=* "string" NOT ([|inputlookup stuff.csv | fields ] )|

Re: Exclude Events Based on a Lookup

paddy3883 — Tue, 19 Feb 2013 08:51:49 GMT

I managed to get this working with this subsearch string

host=EXAMPLE earliest=-3h latest=-1h[ | inputlookup example_exclude| eval search="Message!=\""+ErrorText+"\"" | fields search ]