Hi All,
I have drafted a splunk query (splunk versin 6.6.2 ) which gives certain fields and i tabulated those fields .
I have field name (CommonName) , i want to exclude a particular event based on CommonName which is already present in a lookuptable (inputlookup CN_SAN_list.csv ).
For few events which is not present in lookuptable still i am NOT getting those events in query.
Please give some idea to fix this issue .
Thanks in advance .
Query :
index=ssl_certificate sourcetype="ssl:pending" (Request_CommonName="abc.com" OR SAN="abc.com")
| dedup RequestID
| rex max_match=0 field=Request_EMail "(?.com)"
| eval occurrences=mvcount(Mail)
| eval Request_EMail=lower(Request_EMail)
| eval access=if(((occurrences>1 OR Request_EMail like "dl-%@%.com" OR Request_EMail like "technology%@%.com" OR Request_EMail like "bhp%@%.com") AND ( Request_CommonName like "%.ent.abc.net" OR Request_CommonName like "%.abc.com") ),"Grant","reject")
| fields "RequestID","Request_RequesterName","Request_SubmittedWhen","Request_CommonName","CertificateTemplate","Request_EMail","RowId","ConfigString","Table","SAN" ,"occurrences" , "access"
| where access = "Grant"
| sort RequestID
| rename Request_RequesterName as RequesterName,Request_CommonName as CommonName, Request_SubmittedWhen as SubmittedWhen, Request_EMail as EMail
| table "RequesterName","SubmittedWhen","CommonName","CertificateTemplate",RequestID,"EMail","RowId","ConfigString","Table","SAN"
| search NOT
[| inputlookup CN_SAN_list.csv
| table CommonName]
