Hello splunkers ,
I need help with one query. I have all hosts coming in a query when i run index=* and i have some other hosts in a CSV file which i have loaded static using lookups.
I want to run index=* again but I don't want the hosts which are there in CSV to show up in my query.
In short, during search time, i want to exclude all hosts which are there in CSV static file lookup .
I am guessing that join command would work but don't know how can i use .
index="your index" NOT [|inputlookup yourcsvfile]
View solution in original post