Splunk Search

Search for items not matching values from a lookup

gohar
Explorer

Related to http://splunk-base.splunk.com/answers/7581/best-way-to-search-using-a-lookup-table

I want this inverse scenario that what is the best way to search across all of my data and ONLY show items from lookup tables NOT matching with field.

Tags (2)

dwaddle
SplunkTrust
SplunkTrust

This should be easily done with a NOT. Copying gkanapathy's original answer:

sourcetype=web NOT [ inputlookup iptable | fields src_ip | rename src_ip as souce_address ]

abhayneilam
Contributor

Hi,

I have a query like :

index="maa" |rex field="Location" (?(?i)"(abhay)") | eval ONE=lower(ONE) | stats count(ONE) by ONE

my output is coming:

abhay 10

if I give some other keyword which is not matching then it is not diplaying,my output should come as :

abhay 10
murari 0 ( 0 should come along with the keyword name "murari" if no keyword matches..

Please help me to get this one

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...