How to lookup against multiple columns in CSV file?

[neerajs_81]

Hello All,
how can we search against 2 columns of a CSV lookup file and if the value of the field that i am searching for happens to be either of the 2 columns, then exclude those results ? Kind of a whitelist.

Lets say i have a csv table of 2 columns as follows

URLs	UA

i am searching against my firewall logs and if the url field in the events matches  against URLs column of the table  OR the user_agent field from events matches the UA column of the table, then exclude those events
This is what i have come up with but its not working...

index= firewall 
NOT [ | inputlookup  lookup_file.csv | rename url as  URLs | fields url] OR NOT [ |inputlookup lookup_file.csv | rename user_agent as UA | fields user_agent] 
.......

[neerajs_81]

Thanks a lot. Is there other way to merge checking against multiple columns in one input lookup command  given that its referencing the same csv file ?
Right now as you can see we are calling | inputlookup twice for the same csv .  Any way to consolidate into one ? 

[PickleRick]

You could try to somehow transform the inputlookup results in order to split it and form a single usable subsearch but unless it's a huge set, there's no much point.

I don't like subsearches as such but sometimes they are unavoidable. And in your case the subsearches seem to be fairly quick. And remember that they are evaluated before the main search so you don't have to evaluate those inputlookups separately for each main search result line.

[ITWhisperer · Accepted solution]

Try AND instead of OR

index= firewall 
NOT [ | inputlookup  lookup_file.csv | rename url as  URLs | fields url] AND NOT [ |inputlookup lookup_file.csv | rename user_agent as UA | fields user_agent] 
.......