Hello splunkers ,
I need help with one query. I have all hosts coming in a query when i run index=*
and i have some other hosts in a CSV file which i have loaded static using lookups.
I want to run index=*
again but I don't want the hosts which are there in CSV to show up in my query.
In short, during search time, i want to exclude all hosts which are there in CSV static file lookup .
I am guessing that join command would work but don't know how can i use .
Please help
@kannu ,
Try
index="your index" NOT [|inputlookup yourcsvfile]
@kannu ,
Try
index="your index" NOT [|inputlookup yourcsvfile]