How to use the INPUTLOOKUP command on Splunk Cloud

[paksan32]

Hi Everyone,
So we are using SPlunk Cloud and I have created a dashboard that searches for the top 100 most reoccurring messages coming in from out servers. After sifting through this list we pretty much eliminated about 70 of them as none important. Im having trouble with excluding these 70 common errors. I made a query that has a bunch of NOT statements but this isnt practical. I stumbled upon the inputlookup command and uploaded a .csv file that includes the 70 messages we dont care about. However, my search still doesn't seem to look at anything in the csv file. Does anyone have an suggestions?

My search string is:
index=* | inputlookup append=true exludedeerrors.csv | fields message | stats count by Message host index source | sort - count top limit=10

[woodcock]

Like this:

index=* NOT [| inputlookup exludedeerrors.csv | table message | rename message AS Message]
| stats count by Message host index source
| sort - count top limit=10

[bandit]

Possibly you were trying to do a subsearch for the exclusions? BTW you'll also want to specify an index or indexes for better performance if possible.
https://docs.splunk.com/Documentation/Splunk/latest/Search/Usesubsearchtocorrelateevents

index=* NOT [ |inputlookup exludedeerrors.csv | return 1000 message ] 
| top message by host index source 

[bandit]

I've noticed the case for message is consistent - one part of your query has "message" and another part has "Message". Is this intentded? Field names are case sensitive in Splunk

[bandit]

You can use one or more macros for your exclude list. You can also use the macros in multiple queries and just update the macro when your exclude list changes.
https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Usesearchmacros

Also take a look at the ** IN ** command

instead of

NOT message="this" NOT message="that" NOT message="those"

try

NOT message IN ("this","that","those")