How to use a lookup to filter raw data from a log?

[jip12048]

Hi all,

I am new to Spluntk and have problem with my search.

I have a Lookup table: Error.csv

Filter
*Error1*
*Error2*
*Error3*
...

I want to use this Lookup table to filter the raw data from logs.  However the raw data does not exactly match the values from the Lookup but rather includes Error1, Error2 ... I am trying to only show the logs that do not include these specific messages from the Lookup table.

My query:

basesearch | table _raw, host, source [| inputlookup Error.csv ]| fields Filter| where NOT raw=Filter

The query does not show any results and i have been trying to get it to work for hours now, but somehow can not figure out how.

[gcusello · Accepted solution]

Hi @jip12048,

you have to use a feature of lookups, please try this solution:

basesearch [ | inputlookup Error.csv | rename error as query | fields query ]
| table _time _raw host source

 Ciao.

Giuseppe