Splunk Search

Return only events where field value is in lookup table

bcarr12
Path Finder

Hi all,

I am running a search that returns many events. Some of these events contain a field value that is also in a lookup table I have uploaded. What is the best way to format my search in such a way that it ONLY returns events where the field value in the event is present in the lookup table? Right now, the lookup itself works, but the search returns all events, whether it can look up the field value or not.

Thanks!

jkat54
SplunkTrust
SplunkTrust
 index=myindex [ | inputlookup lookupname.csv | fields field1 field2 field3 | format] | ... rest of search

This will make a huge or statement with each of your fields:

 index=myindex ((field1=value) OR (field2=value2) OR field3=value3))

Add a NOT in front of the sub search if you want events that do not match fields&values in the lookup.

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...