Splunk Search

How to extract fields from an index that do not match with values in a lookup table?

avis1119
New Member

Hi All,

I am trying to write a search for extracting fields which are not matching with the lookup file or table. For example, I have the field named category and a lookup table with values similar to category in the index. Now I want to extract fields from the index which are not matching with values in the lookup table. Please help me in writing the search.

Thank you in advance

0 Karma

avis1119
New Member

i have url category, url, username fields in the index and url category in the lookup

0 Karma

woodcock
Esteemed Legend

Generally, like this:

... NOT [|inputlookup MyLookup | fields MyFieldToNotMatch]

Just put your base search in place of the ellipsis ( ... ).

0 Karma

somesoni2
Revered Legend

Can you provide name of fields in the index and all fields available in lookup?

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...