https://community.splunk.com/t5/Getting-Data-In/Source-from-inputlookup-to-negative-match-against-index/m-p/320895#M59880 <P>Try like this</P> <PRE><CODE>index=dev_applications | stats count by url_host | table url_host | rename url_host as app | eval hasEvent=1 | append [| | inputlookup application_names.csv | table app| dedup app | eval hasEvent=0] | stats max(hasEvent) as hasEvent by app | where hasEvent=0 </CODE></PRE> Tue, 05 Dec 2017 23:14:36 GMT somesoni2 2017-12-05T23:14:36Z https://community.splunk.com/t5/Getting-Data-In/Source-from-inputlookup-to-negative-match-against-index/m-p/320894#M59879 <P>Hello all!</P> <P>I am trying to source from a CSV, do a negative lookup against an index, and then output anything from the CSV that did not return results in the index. </P> <P>Our CSV contains a list of web applications. I want to take this list and run it against an index that contains web logs and output applications haven't produced logs in the past 30 days.</P> <P>The CSV contains the following columns with app being the application name:<BR /> guid,app,version,epoch_time</P> <P>The index has a field called url_host that exists on web log events and is the application name.</P> <P>Here is what I have so far that is <EM>sort</EM> of working:</P> <P>| inputlookup application_names.csv | dedup app | eval url_host=app | fields url_host | search NOT [search index=dev_applications | dedup url_host | fields url_host ] | sort url_host </P> <P>In my output, I am still getting application names that have events in the dev_applications index so it appears not everything is getting filtered out. Not sure if I am doing something wrong or possibly hitting a subsearch limit of some kind. </P> <P>I've been banging my head against this for a few hours...any help is appreciated!</P> Tue, 29 Sep 2020 17:04:22 GMT https://community.splunk.com/t5/Getting-Data-In/Source-from-inputlookup-to-negative-match-against-index/m-p/320894#M59879 coryjett 2020-09-29T17:04:22Z https://community.splunk.com/t5/Getting-Data-In/Source-from-inputlookup-to-negative-match-against-index/m-p/320895#M59880 <P>Try like this</P> <PRE><CODE>index=dev_applications | stats count by url_host | table url_host | rename url_host as app | eval hasEvent=1 | append [| | inputlookup application_names.csv | table app| dedup app | eval hasEvent=0] | stats max(hasEvent) as hasEvent by app | where hasEvent=0 </CODE></PRE> Tue, 05 Dec 2017 23:14:36 GMT https://community.splunk.com/t5/Getting-Data-In/Source-from-inputlookup-to-negative-match-against-index/m-p/320895#M59880 somesoni2 2017-12-05T23:14:36Z