Getting Data In

Using a csv lookup to exclude results from a query, but not working if more than one column of fields

sknot1454
Explorer

I have a lookup table that I want to use to exclude results from a search. I want to exclude results if something in Field A matches OR something matches in Field B.

Field A|Field B
Data|Data

If I only use one column in the CSV(column with Field A) and run it with my query: "sourcetype=bla | search NOT [inputlookup blahlookup]", the data I want excluded from field A is excluded. If include both columns in my lookup, it won't exclude any results.

Is this possible or will I have to make up a separate lookup table for Field B and use an OR statement in my query?

0 Karma
1 Solution

sknot1454
Explorer

That eval definitely looks promising. Thanks!

0 Karma

sundareshr
Legend

If this works, please mark this answer as accepted to close it out.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...