Splunk Search

How to search a lookup table and return the unmatched term?

sabeqa
Engager

i am trying to search for the allowed urls (passthrough) and not in my list uploaded csv called url. the csv is made of only 1 column with a header called hostname

fgt_webfilter profile=* status=passthrough NOT [ inputlookup url ]

i am not getting the correct output

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...