Splunk Search

Return values in CSV lookup not in index


My CSV has 98 rows and I want the search to return the rows from that csv if they are not in my index=gcp*

what i have here is the opposite, it matches if its in index=gcp* -- i need to flip it basically.

| rename data.jsonPayload.rule_details.reference as FW
| search FW = "network:prod*"
| rex field=FW "network:prod-a/firewall:(?<fw>.*)"
| rex field=FW "network:prod-b/firewall:(?<fw>.*)"
| rex field=FW "network:prod-c/firewall:(?<fw>.*)"
| rex field=FW "network:prod-d/firewall:(?<fw>.*)"
| rex field=FW "network:prod-e/firewall:(?<fw>.*)"
| lookup firewall-exception-prod-num.csv firewall_rule as fw OUTPUT firewall_rule as fw
| dedup fw
| table fw
0 Karma

Ultra Champion

use |inputlookup your_csv

Get Updates on the Splunk Community!

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...