Splunk Search

Exclude results from lookup table in search

tromero3
Path Finder

I have a lookup table with Scheduled Tasks called Scheduled_Tasks, and only one column in it called "Task_Name".  This matches the "TaskName" field in my events.

I need to do a search where I only display results where the TaskName field in events DOES NOT contain a value in the Scheduled_Tasks lookup table.  I've looked at almost every question/answer on this topic and came up with this , however it is not excluding anything I have in the lookup table. What am I Doing wrong? Thank you!

index=myindex EventID=4698 NOT [|inputlookup Scheduled_Tasks | fields Task_Name]

Labels (1)
0 Karma
1 Solution

to4kawa
Ultra Champion

index=myindex EventID=4698 NOT [|inputlookup Scheduled_Tasks |rename   Task_Name as TaskName |  fields TaskName]

 

try rename

View solution in original post

TurboTurtle
Engager

I have been trying to add another column, but it's giving me different condition logic. Let's say I want to also filter it not just on a task name in CSV, but with EventCode included.

TaskNameEventCode
Microsoft Edge4101
Firefox4101

 

I tried this:

AND NOT [ | inputlookup wineventlog_exclusions_v2.csv | rename TaskName as query | fields query, EventCode ]

However it doesn't give me what I want, it converts it to:

(NOT EventCode="4104" OR NOT "Microsoft Edge") (NOT EventCode="4104" OR NOT "Firefox"))

I want this:

AND NOT ((EventCode="4104" AND "Microsoft Edge") OR (EventCode="4104" AND "Firefox"))

0 Karma

to4kawa
Ultra Champion

index=myindex EventID=4698 NOT [|inputlookup Scheduled_Tasks |rename   Task_Name as TaskName |  fields TaskName]

 

try rename

tromero3
Path Finder

That worked! Thank you 🙂

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...