Splunk Search

List Codes that are not in the lookup table

aquinojason
Path Finder

Hi,

I have a list of accounting codes in a lookup table. I use that to identify applications under that accounting code and . If the accounting code is not in the lookup table, it becomes "Others". How do I generate a report wherein the results will only list those "Others" and showing the accounting code used?

 

Thanks and Regards,

Labels (1)
0 Karma
1 Solution

ITWhisperer
Ultra Champion

| where accountingCode="Others"

View solution in original post

0 Karma

ITWhisperer
Ultra Champion

| where accountingCode="Others"

View solution in original post

0 Karma

aquinojason
Path Finder

Hi,

Thank you very much for the response and support. I have learned a lot from your answers.

 

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!