Getting Data In

Use inputlookup to get list of hosts that DID NOT match?

the_wolverine
Champion

I have a list of hosts in a lookup file called myhost.csv. I pipe my search results through this list to get a list of hosts that match those in my lookup file, however, I actually want Splunk to output a list of hosts from my lookupfile that DID NOT return results.

Does this make sense?

Tags (2)
0 Karma
1 Solution

jeff
Contributor

Something like this?

| inputlookup myhosts.csv | search NOT [search { whatever criteria } | fields host]

should do what you're looking for.

View solution in original post

jeff
Contributor

Something like this?

| inputlookup myhosts.csv | search NOT [search { whatever criteria } | fields host]

should do what you're looking for.

the_wolverine
Champion

This was really close.

I had to use format to get it to work:

| inputlookup myhosts.csv | search NOT [search stuff | fields host | format ]

0 Karma

Ron_Naken
Splunk Employee
Splunk Employee

Is there an issue with adding a flag to the lookup file, using it as a lookup, then searching for events without the flag?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...