Splunk Search
Highlighted

Search NOT Inputlookup match on 2 columns

Contributor

In a normal search I can do the following:

index=foo sourcetype=csv field1!="blah" AND field2!="hah"

How would I translate this to using a CSV file? I want to use a CSV lookup file to manage the search query without doing the following

index=foo sourcetype=csv (field1!="blah" AND field2!="hah) OR (field1!="hic" AND field2!="cup") OR (field1!="crazy" AND field2!="frog").....

I know I can write a lookup such as

index=foo sourcetype=csv NOT [|inputlookup mycsv.csv | fields field1]

but this would match anything where field1 equals whatever is in the CSV. I need the inputlookup to match field1 AND field2 in the CSV.

Labels (1)
Tags (1)
0 Karma
Highlighted

Re: Search NOT Inputlookup match on 2 columns

Builder

@willadams you can do the following

index=foo sourcetype=csv NOT [
| inputlookup mycsv.csv
| format ]

View solution in original post

0 Karma
Highlighted

Re: Search NOT Inputlookup match on 2 columns

Contributor

Thanks. I was confused with the "format" function and it shows "(AND) OR" and the doco wasn't clear on what was actually happening with that command.

0 Karma
Highlighted

Re: Search NOT Inputlookup match on 2 columns

Builder

@willadams it carries out the AND operation for values of each row col, so (row0col1 AND row0col2 and row0col3 .. AND row0coln)
followed by the OR operation for all the rows ((row0col1 AND row0col2 and row0col3 .. AND row0coln) OR (row1col1 AND row1col2 and row1col3 .. AND row1coln) OR (rowncol1 AND rowncol2 and rowncol3 .. AND rowncoln))

Hope that clarifies 🙂

0 Karma