How to exclude combinations of values in lookup from search?

[ilya]

Hi, Team!

I have a rule:

index = example source = "Rule" | fields user, src_time, src_app, src, src_lat, src_long, src_city, src_country, dest_time, dest_app, dest, dest_lat, dest_long, dest_city, dest_country, distance, speed | stats count by dest, dest_app

And there is a lookup, in which the ip addresses and apps are indicated in two columns.

How can I exclude from the rule a bunch of ip and applications that are in the lookup?

Thank you for your time!

[PickleRick]

<<your search>> NOT ([ | inputlookup yourlookup.csv ]) 

I'm not sure the parentheses are necsssary but they won't hurt 😉

You might need to rename columns in the subsearch so they match field names from your search.