Hi Team, what is the search query to remove the first two rows from lookup table

[aaa2324]

Tried inputlookup=abc | search NOT “row value” ,, but still getting the rows 

I want to remove the entire two rows (first and second ) ; please help

[gcusello]

Hi @aaa2324,

let me understand: do you want to have ad search results all the lookup rows but not the first two rows or to delete the first two rows of a lookup?

in first case, you could run something like this:

| inputlookup abc.csv start=2
| table *

in the second case, you have to add the outputlookup command at the end of the search, something like this:

| inputlookup abc.csv start=2
| table *
| outputlookup abc.csv

You can find more infos at https://docs.splunk.com/Documentation/Splunk/8.1.0/SearchReference/Inputlookup

Ciao.

Giuseppe