Splunk Search

Why is my search no longer excluding results from a lookup table?

Meena_0627
New Member
index=test  action=allowed app=smtp client_ip!=x.x.x.x | iplocation dest_ip | stats count values(Country) values(client_ip) by dest_ip | search NOT [| inputlookup Email_exclusion]

This is my search. I am trying to exclude the dest_ip from the lookup table from the search. It was working before and suddenly stopped.

Any idea what could have gone wrong?

0 Karma

jplumsdaine22
Influencer

What do you get if you run the following search | inputlookup Email_exclusion ?

Unless you get a single column table headed dest_ip then the search will not exclude values as you hope. There may be a problem with the lookup table.

0 Karma

Meena_0627
New Member

Yeah did that and I could see the results of my lookup table...

0 Karma

jplumsdaine22
Influencer

In the Job Inspector, you should be able to see what the expanded subsearch looks like (have a look for the section remoteSearch)

It should look something like:

index=test  action=allowed app=smtp client_ip!=x.x.x.x | iplocation dest_ip | stats count values(Country) values(client_ip) by dest_ip | search NOT (dest_ip=x.x.x.x OR dest_ip=x.x.x.x OR dest_ip=x.x.x.x OR dest_ip=x.x.x.x OR dest_ip=x.x.x.x OR dest_ip=x.x.x.x OR dest_ip=x.x.x.x OR dest_ip=x.x.x.x)

That is, it will show the expanded subsearch. Is that how it looks?

0 Karma

Meena_0627
New Member

Here is how it looks like:

search index=test action=allowed app=smtp client_ip!=x.x.x.x | iplocation dest_ip | stats count values(Country) values(client_ip) by dest_ip | search NOT ( ( dest_ip="x.x.x.x" ) OR ( dest_ip="x.x.x.x" ) OR ( dest_ip="x.x.x.x" ) OR ( dest_ip="x.x.x.x" ) OR ( dest_ip="x.x.x.x" ) OR ( dest_ip="x.x.x.x" ) OR ( dest_ip="x.x.x.x" ) )

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What changed between when the search worked and when it suddenly stopped?

---
If this reply helps you, Karma would be appreciated.
0 Karma

Meena_0627
New Member

I am not sure, it was working a week before.. the same query... but now i see no results though there are logs

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...