How to discard users that start with a urn:forms:anonymous#?

[Netza]

I have some users that start with urn:forms:anonymous# in my lookup
I was trying to to discard them use urn:forms:anonymous#*

 i guess i have to use regex to bring al the users to start like this urn:forms:anonymous#

[SplunkyTUM]

You could try to add a filter in your lookup definition.

Assuming the field/column in your csv file that contains the users is called "user":

Open the lookup definition, check Advanced options, add

user!="urn:forms:anonymous#*"

under Filter lookup.

[isoutamo]

Hi

here is one example how you could do it https://community.splunk.com/t5/Splunk-Search/Where-to-find-unmatched-regex-events/m-p/440340. If you are not needing those on your lookup, then create it without those.

r. Ismo