Splunk Search

Best way to exclude specific combinations from results

gdavid
Path Finder

I have a report that i get and it contains specific sets of data results i want to exclude:
ex:

Group Name, Who Change It, Who Changed in the Group, Add/Removed

i want to exclude results for a specific set of Group Name, Who Change It & Who Changed in the Group

My AD Group1 , admin1, user1
My AD Group2 , admin1, user2
My AD Group3 , admin2, user2

what is the best scalable way to do this, just curious if there is a better way than make my query a page long and adding in the exclusion sets there.

Tags (2)
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

You can just put the exclusion sets into a lookup table myexclusion.csv with the fields group user1 user2 excludereason

your query 
| fields group user1 user2 some other stuff 
| lookup myexclusion.csv group user1 user2 OUTPUT excludereason
| where isnull(excludereason)

See the lookup command for details on how to look things up when the name of the external field does not match the name of the lookup key field(s).

http://docs.splunk.com/Documentation/SplunkCloud/6.6.1/SearchReference/Lookup

I believe if the user1 field in the lookup is named "foo" in the event, then the syntax is

| lookup mylookup.csv   user1 as foo   OUTPUT bar

View solution in original post

lfedak_splunk
Splunk Employee
Splunk Employee

Hey @gdavid, if DalJeanis solved your problem, please don't forget to accept an answer! You can upvote posts as well. (Karma points will be awarded for either action.) Happy Splunking!

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

You can just put the exclusion sets into a lookup table myexclusion.csv with the fields group user1 user2 excludereason

your query 
| fields group user1 user2 some other stuff 
| lookup myexclusion.csv group user1 user2 OUTPUT excludereason
| where isnull(excludereason)

See the lookup command for details on how to look things up when the name of the external field does not match the name of the lookup key field(s).

http://docs.splunk.com/Documentation/SplunkCloud/6.6.1/SearchReference/Lookup

I believe if the user1 field in the lookup is named "foo" in the event, then the syntax is

| lookup mylookup.csv   user1 as foo   OUTPUT bar

gdavid
Path Finder

Thanks, i was looking into how to do this with a lookup and your example helped clear up a bunch of questions.
FYI, excludereason is key 🙂

DalJeanis
SplunkTrust
SplunkTrust

@gdavid - True. I believe there are other ways to figure out if it was a match, but that's the easy one for me.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...