Splunk Search

How to use a lookup to omit data from results?

ho000dor
Explorer

Hi,
Do i need to do a subsearch for this or is there a more efficient way?

I'm trying to ignore every URL in the "URL" column from the lookup...

index="test1" RESPONSE="50*" URL="*" NOT | lookup 500KNOWN URL

The lookup just has a column with URLs that I want to ignore.

Tags (3)
1 Solution

somesoni2
Revered Legend

Use this syntax

   index="test1" RESPONSE="50*" NOT [|inputlookup 500KNOWN | table URL]

View solution in original post

Raghav2384
Motivator

I would use a sub-search.
Example: sourcetype=testapp [|inputlookup userlookup.csv|rename username as user|fields user|where user != "user4"]|stats count by user

0 Karma

subtrakt
Contributor

Thanks I'll give this a shot!

0 Karma

somesoni2
Revered Legend

Use this syntax

   index="test1" RESPONSE="50*" NOT [|inputlookup 500KNOWN | table URL]

subtrakt
Contributor

index="test1" RESPONSE="50*" NOT [|inputlookup 500KNOWN | table URL] | timechart count by URL

0 Karma

somesoni2
Revered Legend

What is your current query with timechart?

0 Karma

subtrakt
Contributor

Thanks! Will this work with timechart on the main search?

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...