Related to http://splunk-base.splunk.com/answers/7581/best-way-to-search-using-a-lookup-table
I want this inverse scenario that what is the best way to search across all of my data and ONLY show items from lookup tables NOT matching with field.
This should be easily done with a NOT. Copying gkanapathy's original answer:
sourcetype=web NOT [ inputlookup iptable | fields src_ip | rename src_ip as souce_address ]
I have a query like :
index="maa" |rex field="Location" (?(?i)"(abhay)") | eval ONE=lower(ONE) | stats count(ONE) by ONE
my output is coming:
if I give some other keyword which is not matching then it is not diplaying,my output should come as :
murari 0 ( 0 should come along with the keyword name "murari" if no keyword matches..
Please help me to get this one