hello splunkers,
I need to exclude in my search, IP values in the second lookup file
| inputlookup file1_lookup.csv | search [|inputlookup file2csv.csv ]
How to resolve that?
Rq:field name= IP Address in the first lookup file
field name= dst in the second lookup file
thanks.
Can you try this?
| inputlookup file1_lookup.csv | search [|inputlookup file2csv.csv | fields dst | rename dst AS "IP Address"]
Regards,
Olivier
Hello Olivier thanks for help,
but in my search I have to exclude values for "IP Address" in the second file.
I don't know if I can use the terme NOT to exclude values?