Splunk Search

How can I remove entries from an existing lookup table?

Ultra Champion

I have a lookup table from which I need to remove a couple of lines. How can I do it?

Tags (2)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

@ddrillic are you looking for inputlookup --> Filter Unwanted Results --> outputlookup?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

SplunkTrust
SplunkTrust

@ddrillic are you looking for inputlookup --> Filter Unwanted Results --> outputlookup?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

Ultra Champion

Right @niketnilay ; -) this one did it - | inputlookup <lookup name> | search host != host* | outputlookup <lookup name>

Based on How to remove a row from lookup table and update it?

@niketnilay - please convert to an answer.