I have a simple lookup file with two fields, user and host
user host
Bob 1
Dave 2
Karen x
Sue y
I want exclude any results from my search where there is any combination of host AND user where they match any value from the lookup.
For example, exclude any results where:
the user is Bob and the host is either 1, 2, x or y
the user is either Bob, Dave, Karen or Sue and the host is x
I'm playing with this search, which appears to work but unsure if there's a flaw in my logic, or if there's a better way to do it?
index=proxy sourcetype="proxy logs"
user="*"
NOT ([| inputlookup lookup.csv | fields user | format ] AND [| inputlookup lookup.csv | fields host | format ])
| stats c by username, host
Thanks in advance
Try something like this
index=proxy sourcetype="proxy logs"
user="*"
NOT [| inputlookup lookup.csv | eventstats values(host) as host | mvexpand host | format ]
| stats c by username, host