I have a lookup table that I want to use to exclude results from a search. I want to exclude results if something in Field A matches OR something matches in Field B.
Field A|Field B
Data|Data
If I only use one column in the CSV(column with Field A) and run it with my query: "sourcetype=bla | search NOT [inputlookup blahlookup]", the data I want excluded from field A is excluded. If include both columns in my lookup, it won't exclude any results.
Is this possible or will I have to make up a separate lookup table for Field B and use an OR statement in my query?
See similar question answered here
https://answers.splunk.com/answers/129068/using-lookup-tables-to-exclude-timerange-from-search.html
See similar question answered here
https://answers.splunk.com/answers/129068/using-lookup-tables-to-exclude-timerange-from-search.html
That eval definitely looks promising. Thanks!
If this works, please mark this answer as accepted to close it out.