Splunk Search

Can you help me use the inputlookup command to return results from one table but not another?

abidgoliwb
New Member

I have two tables. How can I use the inputlookup command so I only get results of the entries that are NOT in the 2nd table.

Tables 1
A 1 one
A 1 two
A 1 three
B 5 one
C 6 one

2nd table
B Done
C Done

Return
A 1 one
A 1 two
A 1 three

Tried it as follows but does not work.

| inputlookup table1  | eval flag1="1"
   | join type=inner  [ inputlookup table2  |eval flag2="1" ]
| where isnull(flag2)

Thanks

Tags (2)
0 Karma
1 Solution

Vijeta
Influencer

Try this

 | inputlookup table1  | eval flag1="1"
    | join type=outer [ inputlookup table2  |eval flag2="1" ]
 | where isnull(flag2)

View solution in original post

0 Karma

Vijeta
Influencer

Try this

 | inputlookup table1  | eval flag1="1"
    | join type=outer [ inputlookup table2  |eval flag2="1" ]
 | where isnull(flag2)
0 Karma

abidgoliwb
New Member

Perfect. Thanks

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...