Splunk Search

Can you help me use the inputlookup command to return results from one table but not another?

abidgoliwb
New Member

I have two tables. How can I use the inputlookup command so I only get results of the entries that are NOT in the 2nd table.

Tables 1
A 1 one
A 1 two
A 1 three
B 5 one
C 6 one

2nd table
B Done
C Done

Return
A 1 one
A 1 two
A 1 three

Tried it as follows but does not work.

| inputlookup table1  | eval flag1="1"
   | join type=inner  [ inputlookup table2  |eval flag2="1" ]
| where isnull(flag2)

Thanks

Tags (2)
0 Karma
1 Solution

Vijeta
Influencer

Try this

 | inputlookup table1  | eval flag1="1"
    | join type=outer [ inputlookup table2  |eval flag2="1" ]
 | where isnull(flag2)

View solution in original post

0 Karma

Vijeta
Influencer

Try this

 | inputlookup table1  | eval flag1="1"
    | join type=outer [ inputlookup table2  |eval flag2="1" ]
 | where isnull(flag2)
0 Karma

abidgoliwb
New Member

Perfect. Thanks

0 Karma
Get Updates on the Splunk Community!

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...

Auto-Injector for Everything Else: Making OpenTelemetry Truly Universal

You might have seen Splunk’s recent announcement about donating the OpenTelemetry Injector to the ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...