I'm trying to optimize my Splunk Windows Event Log dashboard, and wanted to add CSV exclusion file that would filter out some events that aren't necessary to monitor. CSV file contents: TaskName EventCode Microsoft Edge 4101 Firefox 4101   To filter events, I tried this search query: AND NOT [ | inputlookup wineventlog_exclusions_v2.csv | rename TaskName as query | fields query, EventCode ] However it doesn't give me what I want, it converts search string to: (NOT EventCode="4104" OR NOT "Microsoft Edge") (NOT EventCode="4104" OR NOT "Firefox")) But I want this: AND NOT ((EventCode="4104" AND "Microsoft Edge") OR (EventCode="4104" AND "Firefox"))   Is there an easy way of using "AND" OR "AND" for CSV inputlookup? ... View more