Using a csv lookup to exclude results from a query, but not working if more than one column of fields

[sknot1454]

I have a lookup table that I want to use to exclude results from a search. I want to exclude results if something in Field A matches OR something matches in Field B.

Field A|Field B
Data|Data

If I only use one column in the CSV(column with Field A) and run it with my query: "sourcetype=bla | search NOT [inputlookup blahlookup]", the data I want excluded from field A is excluded. If include both columns in my lookup, it won't exclude any results.

Is this possible or will I have to make up a separate lookup table for Field B and use an OR statement in my query?

[sundareshr · Accepted solution]

See similar question answered here

https://answers.splunk.com/answers/129068/using-lookup-tables-to-exclude-timerange-from-search.html

[sknot1454]

That eval definitely looks promising. Thanks!

[sundareshr]

If this works, please mark this answer as accepted to close it out.