Splunk Search

Lookup - How to compare and remove events from the search?

bruno_eduardo
Path Finder

I need to remove a list of servers from my search. This list changes once a month so I thought of using a lookup table. Is it possible? How can I do it?

So in my index, there is a field Server_Name, and on my lookup table there is a field Server_Name_To_Be_Removed. What I need is to compare both fields and remove the events that match value of this field.

Index=Servers    MyBaseSearch   NOT Compared_Equal_Server_Name_To_Be_Removed=Yes
0 Karma
1 Solution

bruno_eduardo
Path Finder

I Got it:

index="Servers" NOT [|inputlookup lookup_name | fields Server_Name] |table Server_Name

First you need to import the .csv file on Settings --> Lookups --> Add New --> Lookup File and the Lookup Definition

The important thing is: the field name must be the same.

Thanks

View solution in original post

0 Karma

bruno_eduardo
Path Finder

I Got it:

index="Servers" NOT [|inputlookup lookup_name | fields Server_Name] |table Server_Name

First you need to import the .csv file on Settings --> Lookups --> Add New --> Lookup File and the Lookup Definition

The important thing is: the field name must be the same.

Thanks

0 Karma

chaker
Contributor

What does the job inspector say?

It should show the expanded search that your subsearch creates.

Also, check that your lookupfile has been uploaded with the correct application context. Make sure that using <|inputlookup table> on its own gives you the contents of the lookup.

0 Karma

bruno_eduardo
Path Finder

Sorry, but I still can't do it, there was no accepted answer on those posts.

What I am trying to do is:

index=* |fields Server_Name NOT [|inputlookup LookUpTable.csv append=f| fields Server_Name_To_Be_Removed] |Table Server_Name

But is not working

0 Karma

jeffsegal
Explorer

It worked, thank you for your help.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Check the field name in the lookup table. If it's same as as the field name available in base search (Server_Name) then add a rename command in your subsearch after fields command.

Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...