Getting Data In
Highlighted

How to use inputlookup file.csv to filter out results from a search

Contributor

here is my current search that im running
index=test outbound "/22" ciscodsthost!=10.0.0.1| RENAME ciscodsthost AS Scrhost | RENAME ciscosrchost AS Dsthost| stats count by Scrhost, Dst_host

I want to add a inputlookup file.csv that has IPs inside of it that i want to exclude from that search. I want it to do something like -
index=test outbound "/22" ciscodsthost!=10.0.0.1 NOT [|inputlookup file.csv] | RENAME ciscodsthost AS Scrhost | RENAME ciscosrchost AS Dsthost| stats count by Scrhost, Dst_host

i have already uploaded the CSV file to splunk lookups directory and tested that splunk can pull it in. I just cant get the results to filter correctly.

0 Karma
Highlighted

Re: How to use inputlookup file.csv to filter out results from a search

Legend

It works exactly like the search you already wrote, as long as the CSV file contains one single field that's called whatever field you want to filter by. So if for instance the field you want to filter by is cisco_dsthost, your CSV needs to look something like this:

cisco_dsthost
1.1.1.1
1.1.1.2
...

View solution in original post

Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.