Splunk Search
Highlighted

How to extract fields from an index that do not match with values in a lookup table?

New Member

Hi All,

I am trying to write a search for extracting fields which are not matching with the lookup file or table. For example, I have the field named category and a lookup table with values similar to category in the index. Now I want to extract fields from the index which are not matching with values in the lookup table. Please help me in writing the search.

Thank you in advance

0 Karma
Highlighted

Re: How to extract fields from an index that do not match with values in a lookup table?

SplunkTrust
SplunkTrust

Can you provide name of fields in the index and all fields available in lookup?

0 Karma
Highlighted

Re: How to extract fields from an index that do not match with values in a lookup table?

Esteemed Legend

Generally, like this:

... NOT [|inputlookup MyLookup | fields MyFieldToNotMatch]

Just put your base search in place of the ellipsis ( ... ).

0 Karma
Highlighted

Re: How to extract fields from an index that do not match with values in a lookup table?

New Member

i have url category, url, username fields in the index and url category in the lookup

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.