SPLK-1004: Splunk Core Certified Advanced Power User

By Splunk · Question Mode

QuestionQ21

VerifiedFiltering and Formatting Results

Which of the following excludes all entries contained in the lookup file baditems.csv from the search results?

Explanation

A negated inputlookup subsearch reads the CSV lookup and excludes events that match its returned field-value entries. Splunk documents inputlookup as the command for reading a CSV lookup table and shows NOT [| inputlookup <file>] as the pattern for excluding lookup-listed data.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!