Splunk Search

Exclude results from lookup table in search

Dalador
Path Finder

I need to do a search where I only display results where the Arguments, Command fields in events DOES NOT contain a value in the scheduled_tasks lookup table. Where it is going wrong? Thank you!
My query is: 

(index IN (index1, index2)) EventCode=4698 NOT [|inputlookup scheduled_tasks |fields Arguments, Command] | fillnull Arguments value="-" | rex field=_raw "(?P<Command>((?<=\bCommand>).*(?=<)))" | rex field=_raw "(?P<Arguments>((?<=\bArguments>).*(?=<)))" |table Command,Arguments |dedup Command,Arguments

 

My lookup table: 

example3.png

Labels (3)
0 Karma
1 Solution

Dalador
Path Finder

I rewrote my query: 
  EventCode=4698 | fillnull Arguments value="-" | rex field=_raw "(?P<Command>((?<=\bCommand>).*(?=<)))" | rex field=_raw "(?P<Arguments>((?<=\bArguments>).*(?=<)))" |search NOT [|inputlookup scheduled_task |fields Arguments, Command]|table Task_Name, ComputerName,Command,_time,Arguments, Account_Name

This works for me 🙂 

View solution in original post

aasabatini
Builder

HI @Dalador 

try like this:

 

(index IN (index1, index2)) EventCode=4698 [inputlookup scheduled_tasks |fields Arguments, Command | format "(" "(" "AND" ")" "NOT" ")"] | fillnull Arguments value="-" | rex field=_raw "(?P<Command>((?<=\bCommand>).*(?=<)))" | rex field=_raw "(?P<Arguments>((?<=\bArguments>).*(?=<)))" |table Command,Arguments |dedup Command,Arguments

 

Karma given or solution confirmation appreciated

Alessandro

Dalador
Path Finder

Same result 😞 

0 Karma

aasabatini
Builder

hey @Dalador 

can you show me the results of this search?

 

|inputlookup scheduled_tasks |fields Arguments, Command | format "(" "(" "AND" ")" "NOT" ")"

 

if the results is 0 please check if the permission of the lookup is set on  global.

0 Karma

Dalador
Path Finder

I rewrote my query: 
  EventCode=4698 | fillnull Arguments value="-" | rex field=_raw "(?P<Command>((?<=\bCommand>).*(?=<)))" | rex field=_raw "(?P<Arguments>((?<=\bArguments>).*(?=<)))" |search NOT [|inputlookup scheduled_task |fields Arguments, Command]|table Task_Name, ComputerName,Command,_time,Arguments, Account_Name

This works for me 🙂 

View solution in original post

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.