Splunk Search

Lookup - How to compare and remove events from the search?

Path Finder

I need to remove a list of servers from my search. This list changes once a month so I thought of using a lookup table. Is it possible? How can I do it?

So in my index, there is a field Server_Name, and on my lookup table there is a field Server_Name_To_Be_Removed. What I need is to compare both fields and remove the events that match value of this field.

Index=Servers    MyBaseSearch   NOT Compared_Equal_Server_Name_To_Be_Removed=Yes
0 Karma
1 Solution

Path Finder

I Got it:

index="Servers" NOT [|inputlookup lookup_name | fields Server_Name] |table Server_Name

First you need to import the .csv file on Settings --> Lookups --> Add New --> Lookup File and the Lookup Definition

The important thing is: the field name must be the same.

Thanks

View solution in original post

0 Karma

Path Finder

I Got it:

index="Servers" NOT [|inputlookup lookup_name | fields Server_Name] |table Server_Name

First you need to import the .csv file on Settings --> Lookups --> Add New --> Lookup File and the Lookup Definition

The important thing is: the field name must be the same.

Thanks

View solution in original post

0 Karma

Path Finder

What does the job inspector say?

It should show the expanded search that your subsearch creates.

Also, check that your lookupfile has been uploaded with the correct application context. Make sure that using <|inputlookup table> on its own gives you the contents of the lookup.

0 Karma

Path Finder

Path Finder

Sorry, but I still can't do it, there was no accepted answer on those posts.

What I am trying to do is:

index=* |fields Server_Name NOT [|inputlookup LookUpTable.csv append=f| fields Server_Name_To_Be_Removed] |Table Server_Name

But is not working

0 Karma

Explorer

It worked, thank you for your help.

0 Karma

Revered Legend

Check the field name in the lookup table. If it's same as as the field name available in base search (Server_Name) then add a rename command in your subsearch after fields command.

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!