Splunk Search

Return values in CSV lookup not in index


My CSV has 98 rows and I want the search to return the rows from that csv if they are not in my index=gcp*

what i have here is the opposite, it matches if its in index=gcp* -- i need to flip it basically.

| rename data.jsonPayload.rule_details.reference as FW
| search FW = "network:prod*"
| rex field=FW "network:prod-a/firewall:(?<fw>.*)"
| rex field=FW "network:prod-b/firewall:(?<fw>.*)"
| rex field=FW "network:prod-c/firewall:(?<fw>.*)"
| rex field=FW "network:prod-d/firewall:(?<fw>.*)"
| rex field=FW "network:prod-e/firewall:(?<fw>.*)"
| lookup firewall-exception-prod-num.csv firewall_rule as fw OUTPUT firewall_rule as fw
| dedup fw
| table fw
0 Karma

Ultra Champion

use |inputlookup your_csv

Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...