I have a lookup table that I want to use to exclude results from a search. I want to exclude results if something in Field A matches OR something matches in Field B.
Field A|Field B
If I only use one column in the CSV(column with Field A) and run it with my query: "sourcetype=bla | search NOT [inputlookup blahlookup]", the data I want excluded from field A is excluded. If include both columns in my lookup, it won't exclude any results.
Is this possible or will I have to make up a separate lookup table for Field B and use an OR statement in my query?