Getting Data In

Using a csv lookup to exclude results from a query, but not working if more than one column of fields

Explorer

I have a lookup table that I want to use to exclude results from a search. I want to exclude results if something in Field A matches OR something matches in Field B.

Field A|Field B
Data|Data

If I only use one column in the CSV(column with Field A) and run it with my query: "sourcetype=bla | search NOT [inputlookup blahlookup]", the data I want excluded from field A is excluded. If include both columns in my lookup, it won't exclude any results.

Is this possible or will I have to make up a separate lookup table for Field B and use an OR statement in my query?

0 Karma
1 Solution

Explorer

That eval definitely looks promising. Thanks!

0 Karma

Legend

If this works, please mark this answer as accepted to close it out.

0 Karma