Splunk Search

How to use a lookup table field to discard events?

New Member

We have a list of Ips in a lookup table and we want to search events that doesn't match with them.

The lookup definition "scanners_lookup" has a field called "Ip_Scanner" and the events in the index we are looking for has another called "source_ip". How do we build the search? We have tried several approachs that don't work.

For instance:

index=my_index | lookup scanners_lookup  Ip_Scanner | where source_ip != IP_scanner

Thank you!

Labels (1)
0 Karma

Revered Legend

Try like this

index=yourindex sourcetype=yourSourcetype [| inputlookup scanners_lookup | table Ip_Scanner | rename Ip_Scanner as source_ip ]
0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...