Related to http://splunk-base.splunk.com/answers/7581/best-way-to-search-using-a-lookup-table
I want this inverse scenario that what is the best way to search across all of my data and ONLY show items from lookup tables NOT matching with field.
This should be easily done with a NOT
. Copying gkanapathy's original answer:
sourcetype=web NOT [ inputlookup iptable | fields src_ip | rename src_ip as souce_address ]
Hi,
I have a query like :
index="maa" |rex field="Location" (?
my output is coming:
abhay 10
if I give some other keyword which is not matching then it is not diplaying,my output should come as :
abhay 10
murari 0 ( 0 should come along with the keyword name "murari" if no keyword matches..
Please help me to get this one