how to whitelist using lookup table

[ajayrejin]

we have threat logs from firewall. That log contains a signature, which is captured under signature field. my requirement here is to white list 3 fields(signature, source and destination) simultaneously. What i am currently doing is create a lookup table, that 3 columns(signature, source and destination) and their respective value.
I am using the below query, however its doesnt work

index= firewall NOT[|inputlookup whitelist.csv | fields signature,source,destination]

[koshyk]

Your query should have worked.. i.e.

index= firewall NOT [|inputlookup whitelist.csv | fields signature,source,destination]

But please ensure your data in index=firewall contains precisely the fields signature, source, destination (The field names are case-sensitive too) and contains ALL of the fields in each Event. If a single field is missing, you will get empty results.

to debug this, do the fields individually, and test if each of the field works. something like below and test for each field

index= firewall NOT [|inputlookup whitelist.csv | fields signature]

..

[richgalloway]

Try formatting the results of the subsearch.

index= firewall NOT[|inputlookup whitelist.csv | fields signature,source,destination | format]