Splunk Search

Boolean query to exclude value in Filter Lookup

mojoes
Engager

Hi, I am new at Splunk and I'm following the lab in Enriching Data with Lookups, where I'm requested to exclude a value using the Flter Lookup. I have a Lookup definition based on knonwusers.csv

In the video it doesn't explain or show any example for this specific field. I have tried the following:

user NOT (root OR mail OR apache)
user <> (root OR mail OR apache)
|inputlookup knownusers.csv |eval user NOT (root OR mail OR apache)

And nothing is working. Could you please tell me what am I doing wrong? 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You could do something like this

| inputlookup knownusers.csv
| where NOT user IN ("root", "mail", "apache")

Although this might not be classed a filtering using a lookup.

Assuming you have a user field in your events, you could filter them like this

| lookup knownusers.csv user OUTPUT user AS found_user
| where isnull(found_user)

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could do something like this

| inputlookup knownusers.csv
| where NOT user IN ("root", "mail", "apache")

Although this might not be classed a filtering using a lookup.

Assuming you have a user field in your events, you could filter them like this

| lookup knownusers.csv user OUTPUT user AS found_user
| where isnull(found_user)
0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...