Splunk Enterprise Security

How to only show the destination not in the search table?

Miguel3393
Explorer

Hello,

I have a lookup table with numbers, where it checks the numbers that match the error_code 11.


index="cdrs" "error_code"="11" "Destino"="*"


| lookup DIDREPEP Destino OUTPUT Destino | table Destino

But it shows some blank results because they are not in the lookup table.
How can I do so that it only shows me the destination that is not in the search table?.

thanks greetings.

Labels (1)
Tags (2)
0 Karma
1 Solution

paulcurry
Path Finder

Maybe try: 

index="cdrs" "error_code"="11" "Destino"="*"

| lookup DIDREPEP Destino OUTPUT Destino AS foundInLookup

|where isnull(FoundInLookup)

View solution in original post

paulcurry
Path Finder

Maybe try: 

index="cdrs" "error_code"="11" "Destino"="*"

| lookup DIDREPEP Destino OUTPUT Destino AS foundInLookup

|where isnull(FoundInLookup)

Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...