Hello,
I have a .csv with 2 columns: hostname and ip.
How can I exclude the IPs from that list ?
Tried something like this, but it doesn't work: src_ip="[|inputlookup ip_list.csv | fields ip]"
The inputlookup subsearch will return a list of IPs in key=value format. It'll look something like
(ip=1.2.3.4 OR ip=4.5.6.7 OR ip=10.11.12.13)
Taken literally, it's an include list - Splunk will return only events with those ip values. Use NOT to make it an exclude list.
index=foo NOT [|inputlookup ip_list.csv | fields ip]
This assumes index foo has a field called "ip". If it doesn't then the subsearch will need a rename command.