Splunk Search
Highlighted

Exclude Events Based on a Lookup

Path Finder

I've written a query to find certain events in Splunk and I want to exclude any which match up with a set of values in a CSV lookup. For example for this query:

Type!=Information (*Example1* OR *Example2* OR "*Example with spaces*") earliest=-4h latest=-1m

And I've a CSV with the following values

ExcludeText

Test1

Test2
Test3

I want to exclude any events which contain the text in the CSV file. I've tried this but it doesn't filter them out:

Type!=Information (*\Example1* OR *Example2* OR "*Example with spaces*") earliest=-4h latest=-1m
[| inputlookup exclude_csv | fields ExcludeText]

Any ideas?

Tags (2)
0 Karma
Highlighted

Re: Exclude Events Based on a Lookup

Contributor

When I do this I just something like:

host=* "string" NOT ([|inputlookup stuff.csv | fields ] )|

Highlighted

Re: Exclude Events Based on a Lookup

Path Finder

I managed to get this working with this subsearch string

host=EXAMPLE earliest=-3h latest=-1h[ | inputlookup example_exclude| eval search="Message!=\""+ErrorText+"\"" | fields search ]

View solution in original post

0 Karma