Getting Data In

How do I make a Splunk query which would exclude hosts which are in a CSV lookup table?

kannu
Communicator

Hello splunkers ,

I need help with one query. I have all hosts coming in a query when i run index=* and i have some other hosts in a CSV file which i have loaded static using lookups.

I want to run index=* again but I don't want the hosts which are there in CSV to show up in my query.

In short, during search time, i want to exclude all hosts which are there in CSV static file lookup .

I am guessing that join command would work but don't know how can i use .

Please help

0 Karma
1 Solution

renjith_nair
Legend

@kannu ,
Try

index="your index"  NOT [|inputlookup yourcsvfile]
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

0 Karma

renjith_nair
Legend

@kannu ,
Try

index="your index"  NOT [|inputlookup yourcsvfile]
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...