Search NOT Inputlookup match on 2 columns

[willadams]

In a normal search I can do the following:

index=foo sourcetype=csv field1!="blah" AND field2!="hah"

How would I translate this to using a CSV file? I want to use a CSV lookup file to manage the search query without doing the following

index=foo sourcetype=csv (field1!="blah" AND field2!="hah) OR (field1!="hic" AND field2!="cup") OR (field1!="crazy" AND field2!="frog").....

I know I can write a lookup such as

index=foo sourcetype=csv NOT [|inputlookup mycsv.csv | fields field1]

but this would match anything where field1 equals whatever is in the CSV. I need the inputlookup to match field1 AND field2 in the CSV.

[anmolpatel · Accepted solution]

@willadams you can do the following

index=foo sourcetype=csv NOT [
| inputlookup mycsv.csv
| format ]

[willadams]

Thanks. I was confused with the "format" function and it shows "(AND) OR" and the doco wasn't clear on what was actually happening with that command.

[anmolpatel]

@willadams it carries out the AND operation for values of each row col, so (row0col1 AND row0col2 and row0col3 .. AND row0coln)
followed by the OR operation for all the rows ((row0col1 AND row0col2 and row0col3 .. AND row0coln) OR (row1col1 AND row1col2 and row1col3 .. AND row1coln) OR (rowncol1 AND rowncol2 and rowncol3 .. AND rowncoln))

Hope that clarifies 🙂