Splunk Search

not equal values in a dataset

moayadalghamdi
Path Finder

Hello splunker, i want to write an SPL to list email senders excluding emails in a predefined lookup table.

 

here's my command:

index=email eventtype="email-events" action=delivered [ | inputlookup group_service_emails_csv.csv| fields Emails | where sender != Emails]

please help me with it, Thanks

 

Labels (3)
0 Karma
1 Solution

moayadalghamdi
Path Finder

i found the answer, just write NOT infrot of the lookup search, like this and modify the  WHERE to RENAME:

 

 

index=email eventtype="email-events" action=delivered  NOT [ | inputlookup group_service_emails_csv.csv| fields Emails | rename Emails as sender ]

View solution in original post

0 Karma

moayadalghamdi
Path Finder

i found the answer, just write NOT infrot of the lookup search, like this and modify the  WHERE to RENAME:

 

 

index=email eventtype="email-events" action=delivered  NOT [ | inputlookup group_service_emails_csv.csv| fields Emails | rename Emails as sender ]

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...