Splunk Search

How to use a lookup csv to exclude items from a search

Motivator

I have a search that is looking for IDS events. I want to exclude some known src and dest IP's for count = x. So my lookup file will be like this.

src,dest,count

So how to i do the search and exclude where the items in the lookup exist in the search.

Thanks for any help....

Tags (1)

SplunkTrust
SplunkTrust

Maybe a non inclusive subsearch?

your_search_for_ids [|inputlookup your_lookup.csv append=f| fields src dest|format "NOT (" "(" "" ")" "OR" ")"]

The NOT in the format command will tell the main search to NOT use the src AND dest from the lookup. So if your lookup is:

src,dest,count
server1,server2,3
server2,server3,3

Then the subsearch evaluates to NOT ((src="server1" AND dest="server2")OR(src="server2" AND dest="server3") )

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!