Splunk Search

Search for items not matching values from a lookup


Related to http://splunk-base.splunk.com/answers/7581/best-way-to-search-using-a-lookup-table

I want this inverse scenario that what is the best way to search across all of my data and ONLY show items from lookup tables NOT matching with field.

Tags (2)


This should be easily done with a NOT. Copying gkanapathy's original answer:

sourcetype=web NOT [ inputlookup iptable | fields src_ip | rename src_ip as souce_address ]



I have a query like :

index="maa" |rex field="Location" (?(?i)"(abhay)") | eval ONE=lower(ONE) | stats count(ONE) by ONE

my output is coming:

abhay 10

if I give some other keyword which is not matching then it is not diplaying,my output should come as :

abhay 10
murari 0 ( 0 should come along with the keyword name "murari" if no keyword matches..

Please help me to get this one

0 Karma