Hi,
Do i need to do a subsearch for this or is there a more efficient way?
I'm trying to ignore every URL in the "URL" column from the lookup...
index="test1" RESPONSE="50*" URL="*" NOT | lookup 500KNOWN URL
The lookup just has a column with URLs that I want to ignore.
Use this syntax
index="test1" RESPONSE="50*" NOT [|inputlookup 500KNOWN | table URL]
I would use a sub-search.
Example: sourcetype=testapp [|inputlookup userlookup.csv|rename username as user|fields user|where user != "user4"]|stats count by user
Thanks I'll give this a shot!
Use this syntax
index="test1" RESPONSE="50*" NOT [|inputlookup 500KNOWN | table URL]
index="test1" RESPONSE="50*" NOT [|inputlookup 500KNOWN | table URL] | timechart count by URL
What is your current query with timechart?
Thanks! Will this work with timechart on the main search?