Splunk Search

How to extract fields from an index that do not match with values in a lookup table?

New Member

Hi All,

I am trying to write a search for extracting fields which are not matching with the lookup file or table. For example, I have the field named category and a lookup table with values similar to category in the index. Now I want to extract fields from the index which are not matching with values in the lookup table. Please help me in writing the search.

Thank you in advance

0 Karma

New Member

i have url category, url, username fields in the index and url category in the lookup

0 Karma

Esteemed Legend

Generally, like this:

... NOT [|inputlookup MyLookup | fields MyFieldToNotMatch]

Just put your base search in place of the ellipsis ( ... ).

0 Karma

SplunkTrust
SplunkTrust

Can you provide name of fields in the index and all fields available in lookup?

0 Karma