CSV Lookup - Exclusions - Help Required.

[driva]

Hi guys,

I'm trying to work out what's wrong with my search (see below). I have a CSV lookup file with a list of names that I would like to exclude from the search results.

index=new RequestID=* NOT [| inputlookup User_Exclusions.csv | fields Exclude_User ] | stats count | rename count as Total

Any help is greatly appreciated!

Many thanks!

D

[driva · Accepted solution]

Hi guys, I got it working - I was using format in the subsearch however the hiccup I made was that the 'field' Exclude_Users within the CSV did not quite match the Field within Splunk. I made the field of users I wanted to exclude match the field name within the CSV file and it all started working. Thanks for your help, much appreciated!

[rmmiller]

You are missing the format command.

Take a look at this:
https://answers.splunk.com/answers/724348/excluding-a-list-of-ips-from-the-results.html

[driva]

Hi rmmiller, thanks for getting back to me. Unfortunately it does not work with '| format' added. It appears that the inputlookup works when run as an independent search but not as a subsearch.

[richgalloway]

Did you put | format in the subsearch or main search. It should be in the subsearch and it should have worked.