Good morning, all! I am trying to fill in a table based on if an IP address is in a lookup. I have a lookup table called "IPAddresses.csv" with the addresses in a column called "value", and a field in the event called addr. I want to fill a cell in a table with "In IP List" or "Not in IP List" something like this: IPAddresses.csv value Hostname 192.168.1.1 Host A 192.168.1.3 Host B 192.168.1.5 Host C 192.168.1.7 Host D   Splunk Table In IP Addresses addr In List 192.168.1.1 Not In List 192.168.1.2 In List 192.168.1.3 Not In List 192.168.1.4   I have a very immature Splunk knowledge base, so I am not even sure where to start. I would assume that it would require an eval if match statement in conjunction with a lookup, but I am not sure how to join the two. Any help would be greatly appreciated! Thank you! ... View more

I am trying to remove logs based on a lookup. This is what I am using:   index=myindex "string_to_search_for" NOT      [inputlookup mylookup       | rename IP as host       | field host]   The end result is to exclude any logs that have the "host" field in the event. My inputlookup returns the correct value but my NOT statement isnt doing anything. I am very new to Splunk so I am sure that I am missing something pretty easy. Thanks for the help! ... View more