Splunk Search

How to extract fields from an index that do not match with values in a lookup table?

avis1119
New Member

Hi All,

I am trying to write a search for extracting fields which are not matching with the lookup file or table. For example, I have the field named category and a lookup table with values similar to category in the index. Now I want to extract fields from the index which are not matching with values in the lookup table. Please help me in writing the search.

Thank you in advance

0 Karma

avis1119
New Member

i have url category, url, username fields in the index and url category in the lookup

0 Karma

woodcock
Esteemed Legend

Generally, like this:

... NOT [|inputlookup MyLookup | fields MyFieldToNotMatch]

Just put your base search in place of the ellipsis ( ... ).

0 Karma

somesoni2
Revered Legend

Can you provide name of fields in the index and all fields available in lookup?

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...