Getting Data In

How to use inputlookup file.csv to filter out results from a search

sbattista09
Contributor

here is my current search that im running
index=test outbound "/22" cisco_dsthost!=10.0.0.1| RENAME cisco_dsthost AS Scr_host | RENAME cisco_srchost AS Dst_host| stats count by Scr_host, Dst_host

I want to add a inputlookup file.csv that has IPs inside of it that i want to exclude from that search. I want it to do something like -
index=test outbound "/22" cisco_dsthost!=10.0.0.1 NOT [|inputlookup file.csv] | RENAME cisco_dsthost AS Scr_host | RENAME cisco_srchost AS Dst_host| stats count by Scr_host, Dst_host

i have already uploaded the CSV file to splunk lookups directory and tested that splunk can pull it in. I just cant get the results to filter correctly.

0 Karma
1 Solution

Ayn
Legend

It works exactly like the search you already wrote, as long as the CSV file contains one single field that's called whatever field you want to filter by. So if for instance the field you want to filter by is cisco_dsthost, your CSV needs to look something like this:

cisco_dsthost
1.1.1.1
1.1.1.2
...

View solution in original post

Ayn
Legend

It works exactly like the search you already wrote, as long as the CSV file contains one single field that's called whatever field you want to filter by. So if for instance the field you want to filter by is cisco_dsthost, your CSV needs to look something like this:

cisco_dsthost
1.1.1.1
1.1.1.2
...
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...