Why are my search results are not matching the lookup table?

[raghav130593]

I am performing a search where I am making use of a CSV lookup and only get those results that match one of the fields in the lookup. Here's my scrubbed out search

index="logs"|regex url = "..."|stats sum(bytes),count(uri) by url ip|lookup csv_lookup ip OUTPUT oe|sort -sum(bytes)

This gives out results with the unmatched events along with the matched events. Any idea what's going wrong?

[lquinn · Accepted solution]

If I'm understanding you correctly, you would like to remove all events that do not have a matching ip from the lookup? The purpose of a lookup is to enrich your data with extra information that is contained within fields in your lookup. It will not filter your events if they do not match. In order to do this you could simply append "| search oe=" to the end of your search. Then only events with the field *oe, which has come from your lookup, will be retained.

[raghav130593]

Great. Sorry I have very limited experience with Splunk hence wasn't aware of that. But, I was able to achieve my result through what you suggested. Thanks.