Getting Data In

How do I make a Splunk query which would exclude hosts which are in a CSV lookup table?

kannu
Communicator

Hello splunkers ,

I need help with one query. I have all hosts coming in a query when i run index=* and i have some other hosts in a CSV file which i have loaded static using lookups.

I want to run index=* again but I don't want the hosts which are there in CSV to show up in my query.

In short, during search time, i want to exclude all hosts which are there in CSV static file lookup .

I am guessing that join command would work but don't know how can i use .

Please help

0 Karma
1 Solution

renjith_nair
Legend

@kannu ,
Try

index="your index"  NOT [|inputlookup yourcsvfile]
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

0 Karma

renjith_nair
Legend

@kannu ,
Try

index="your index"  NOT [|inputlookup yourcsvfile]
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...