Splunk Search

CSV Lookup - Exclusions - Help Required.

Path Finder

Hi guys,

I'm trying to work out what's wrong with my search (see below). I have a CSV lookup file with a list of names that I would like to exclude from the search results.

index=new RequestID=* NOT [| inputlookup User_Exclusions.csv | fields Exclude_User ] | stats count | rename count as Total

Any help is greatly appreciated!

Many thanks!

D

0 Karma
1 Solution

Path Finder

Hi guys, I got it working - I was using format in the subsearch however the hiccup I made was that the 'field' Exclude_Users within the CSV did not quite match the Field within Splunk. I made the field of users I wanted to exclude match the field name within the CSV file and it all started working. Thanks for your help, much appreciated!

View solution in original post

Path Finder

Hi guys, I got it working - I was using format in the subsearch however the hiccup I made was that the 'field' Exclude_Users within the CSV did not quite match the Field within Splunk. I made the field of users I wanted to exclude match the field name within the CSV file and it all started working. Thanks for your help, much appreciated!

View solution in original post

Contributor

You are missing the format command.

Take a look at this:
https://answers.splunk.com/answers/724348/excluding-a-list-of-ips-from-the-results.html

Path Finder

Hi rmmiller, thanks for getting back to me. Unfortunately it does not work with '| format' added. It appears that the inputlookup works when run as an independent search but not as a subsearch.

0 Karma

SplunkTrust
SplunkTrust

Did you put | format in the subsearch or main search. It should be in the subsearch and it should have worked.

---
If this reply helps you, an upvote would be appreciated.
0 Karma