Splunk Search

Search the strings that are not available in lookup file

prettysunshinez
Explorer

All,

I have a question on how to perform a search with the strings that are not available in lookup file..

I have a lookup file as below
Test_Name|Test_Case
Abar|Aliq
Azad|Aliq
And so on

Now i would want to search something like below.

Index= NOT "Abar" NOT "Azad".

How to perform for all the values in lookup file.

Thanks

Tags (1)
0 Karma

niketn
Legend

@prettysunshinez try the following search

index=<yourIndexName> 
    [| inputlookup <yourLookupFile> 
    | stats values(Test_Name) as Test_Name 
    | eval Test_Name=" NOT (\"".mvjoin(Test_Name,"\" OR \"")."\")" 
    | rename Test_Name as search]

Provided your lookup file has Test_Name field values as Abar and Azad the above query will execute a search similar to the following:

index=<yourIndexName> NOT ("Abar" OR "Azad")

Following is a run anywhere example based on Splunk's _internal index with component field where instead of lookup, I am using same index to pull fewer components using recent time and then running the main query for a longer time period to return all the components that were present for overall time but not in the recent time.

index=_internal sourcetype=splunkd log_level!=INFO earliest=-24h latest=now 
    [ search index=_internal sourcetype=splunkd log_level!=INFO earliest=-1h latest=now 
    | stats values(component) as component 
    | eval component=" NOT (\"".mvjoin(component,"\" OR \"")."\")" 
    | rename component as search] 
| stats count by component
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...