Splunk Query required to add Inclusion and exclusion condition

[Tajuddin]

The following query retrieves confroom_ipaddress values from the lookup table that do not match IP addresses found in the indexed logs:

| inputlookup lookup_ist_cs_checkin_rooms.csv where NOT [search index=fow_checkin message="display button:panel-*" | rex field=message "ipaddress: (?<ipaddress>[^ ]+)" | stats values(ipaddress) as confroom_ipaddress | table confroom_ipaddress] | rename confroom_ipaddress as ipaddress1

I would like to add an additional condition to include IP addresses that match those found in the following logs:

index=fow_checkin "Ipaddress(from request header)" | rex field=message "IpAddress\(from request header\):\s*(?<ip_address>\S+)$" | stats values(ip_address) as ip_address2

This means we need to include IP addresses from lookup_ist_cs_checkin_rooms.csv that match with the message "Ipaddress(from request header)" andexclude IP addresses from lookup_ist_cs_checkin_rooms.csv that match with the message "display button:panel-*"  as well. Please help.

[PickleRick]

Your initial search might not be the best way to get what you're searching in the first place. Remember that Splunk's subsearches have their limits and might behave weirdly and give empty or wrong results if those limits are reached.

[ITWhisperer · Accepted solution]

So, if an ip address from lookup_ist_cs_checkin_rooms.csv matches with a message "display button:panel-*" and it matches with an ip address in a message with "Ipaddress(from request header)", do you want to include it or exclude it? That is, which condition takes precedence?