How would I be able to exclude source_ip and destination_ip combination?

[Splunk77]

I have a look up table with two columns. They are for source IP and destination IP addresses. I want to be able to search for firewall traffic logs and filter out any source IP and destination IP combination from the results.

The following query allows for excluding source_ip from the lookup table. How would I be able to exclude source_ip and destination_ip combination?

index=firewall sourcetype=<source_type> NOT [ | inputlookup test.csv

table source_ip] 

| table _time, source_ip, destination_ip, action, protocol 

Thanks.

[richgalloway · Accepted solution]

When you read from the lookup file, include both the source and destination IP addresses.  The trick then is to use the format command to build a search string in the form (src_ip=1.2.3.4 AND dest_ip=5.6.7.8).  It's important to ensure the field names returned by the subsearch match field names available in the main search.

index=firewall sourcetype=<source_type> NOT [ | inputlookup test.csv
fields source_ip destination_ip | format maxresults=0 ] 
| table _time, source_ip, destination_ip, action, protocol