Splunk Search

Exclude results from lookup table in search

Path Finder

I have a lookup table with Scheduled Tasks called Scheduled_Tasks, and only one column in it called "Task_Name".  This matches the "TaskName" field in my events.

I need to do a search where I only display results where the TaskName field in events DOES NOT contain a value in the Scheduled_Tasks lookup table.  I've looked at almost every question/answer on this topic and came up with this , however it is not excluding anything I have in the lookup table. What am I Doing wrong? Thank you!

index=myindex EventID=4698 NOT [|inputlookup Scheduled_Tasks | fields Task_Name]

Labels (1)
0 Karma
1 Solution

Ultra Champion

index=myindex EventID=4698 NOT [|inputlookup Scheduled_Tasks |rename   Task_Name as TaskName |  fields TaskName]

 

try rename

View solution in original post

Ultra Champion

index=myindex EventID=4698 NOT [|inputlookup Scheduled_Tasks |rename   Task_Name as TaskName |  fields TaskName]

 

try rename

View solution in original post

Path Finder

That worked! Thank you 🙂

0 Karma