Splunk Search

How can I remove entries from an existing lookup table?

ddrillic
Ultra Champion

I have a lookup table from which I need to remove a couple of lines. How can I do it?

Tags (2)
0 Karma
1 Solution

niketnilay
Legend

@ddrillic are you looking for inputlookup --> Filter Unwanted Results --> outputlookup?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketnilay
Legend

@ddrillic are you looking for inputlookup --> Filter Unwanted Results --> outputlookup?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

ddrillic
Ultra Champion

Right @niketnilay ; -) this one did it - | inputlookup <lookup name> | search host != host* | outputlookup <lookup name>

Based on How to remove a row from lookup table and update it?

@niketnilay - please convert to an answer.

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!