How can I whitelist based on this 3 conditions- where condition with 3 arguments?

[danutmatei]

Hi, I have an inputlookup with wSender, wSubject and wRecipient. I want to whitelist some of the emails sent by an user to a specific recipient that have a specific subject.

How can I whitelist based on this 3 conditions (Sender=X, Subject=Y, Recipient=Z) ?

I've tried: where Sender!=wSender AND Subject!=wSubject AND Recipient!=wRecipient but in this case all the email sent by wSender are whitelisted.

Also tried index=xxx AND NOT | inputlookup whitelist.csv fields wSender, wSubject, wRecipient - but the same result, the user from wSender is getting whitelisted for all the emails he sent not just the ones from wSubject.

[danutmatei]

working like a charm, thank you

[ITWhisperer · Accepted solution]

By "whitelist", it looks like you are trying to filter OUT anything that matches all 3 fields in any row in your lookup - right? Try something like this

index=xxx AND NOT [| inputlookup whitelist.csv | fields wSender, wSubject, wRecipient | format]