Have a similar requirement. | inputlookup <lookup name> | search host != host* | outputlookup <lookup name> We want to remove a guid record or line containing the guid from the lookup table so we should filter using = or != ? | inputlookup abc | search guid= 123456 | outputlookup abc,  when tried with this ended up in updating only this record for the entire lookup , so ideally the query should be | inputlookup abc | search guid!= 123456 | outputlookup abc right? please clarify on the filtering of the result @ddrillic @niketn Thanks! ... View more

Trying to retrieve the correlationId from two different indexes and then use a table to show them. correlationId field is present in index called abc and properties.correlationID is present in index called cde Example: index=abc OR index=cde sourcetype=json OR sourcetype=_json correlationId="*" OR properties.correlationId=* | table correlationId,properties.correltionId when tried using above we are getting values for correlationId only ... View more