Splunk Search

How to extract fields from an index that do not match with values in a lookup table?

avis1119
New Member

Hi All,

I am trying to write a search for extracting fields which are not matching with the lookup file or table. For example, I have the field named category and a lookup table with values similar to category in the index. Now I want to extract fields from the index which are not matching with values in the lookup table. Please help me in writing the search.

Thank you in advance

0 Karma

avis1119
New Member

i have url category, url, username fields in the index and url category in the lookup

0 Karma

woodcock
Esteemed Legend

Generally, like this:

... NOT [|inputlookup MyLookup | fields MyFieldToNotMatch]

Just put your base search in place of the ellipsis ( ... ).

0 Karma

somesoni2
Revered Legend

Can you provide name of fields in the index and all fields available in lookup?

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...