Splunk Advanced Power User

Practice session

You define a CSV lookup `users.csv` with `user_id` as the key and want events whose `user_id` does NOT appear in the lookup. Which approach is correct?

Loading your practice session…