Splunk Search

Find the missing values in a lookup file from dbquery?

Cuyose
Builder

So I have a dbquery that returns results with a column email.

I created a lookup file with a single column, email. This lookup file only has a subset ~95% of the emails that are returned by my dbquery.

How can I easily make my dbquery only return the missing rows where email from the query does not exist in the lookup file?

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You could add a column to your lookup file like this:

email,in_lookup
foo@example.com,1

and use that field to filter in your search.

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You could add a column to your lookup file like this:

email,in_lookup
foo@example.com,1

and use that field to filter in your search.

0 Karma

Cuyose
Builder

I was able to get this to work, I was artificially outputting the inLookup field and it wasn't working right, so just simply doing this for the lookup |lookup {lookupDef.csv} email |fillnull value="empty" and doing a |search inLookup!=1 at the end worked.

Thanks!

0 Karma

Cuyose
Builder

I understand what you suggested and it made sense, but for some reason it appended my inLookup=1 to all the results, so doing a filter at the end of the entire results |search inLookup!=1 returned 0 results, I'm expecting to see ~200

0 Karma
Get Updates on the Splunk Community!

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...