https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-to-compare-the-value-of-a-field-with-a/m-p/352821#M104430 <P>I edited my answer, please try the new version. If dst_port isn't the field name in your index, then change it to the field name you have for the ports in your indexed data.</P> Tue, 14 Mar 2017 11:03:47 GMT jkat54 2017-03-14T11:03:47Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-to-compare-the-value-of-a-field-with-a/m-p/352818#M104427 <P>Hello!</P> <P>I'm currently trying to compare the value of a field with a csv table.</P> <P>I want to compare the destination port (dst_port) with the values of pwhitelist.csv and display the ports that are not included in the csv data.</P> <P>For example: the csv file consists of the ports 80, 8080, 443 and 8000 want to display all dst_ports that are not 80, 8080, 443 or 8000. </P> <P>Thanks</P> Mon, 13 Mar 2017 17:28:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-to-compare-the-value-of-a-field-with-a/m-p/352818#M104427 soesia12 2017-03-13T17:28:58Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-to-compare-the-value-of-a-field-with-a/m-p/352819#M104428 <PRE><CODE>yourBaseSearch NOT [|inputlookup pwhitelist.csv | fields Ports | rename Ports AS dst_port | format] </CODE></PRE> Mon, 13 Mar 2017 17:47:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-to-compare-the-value-of-a-field-with-a/m-p/352819#M104428 jkat54 2017-03-13T17:47:22Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-to-compare-the-value-of-a-field-with-a/m-p/352820#M104429 <P>Hey!</P> <P>Doesn't work. It just lists all ports.</P> <P>In the file there are just a few ports. At the moments it's just for testing.<BR /> pwhitelist.csv:</P> <P>In the file is only one column with the header "Ports".<BR /> The values 80,443,8000,8080 are in that column.</P> Tue, 14 Mar 2017 06:58:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-to-compare-the-value-of-a-field-with-a/m-p/352820#M104429 soesia12 2017-03-14T06:58:20Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-to-compare-the-value-of-a-field-with-a/m-p/352821#M104430 <P>I edited my answer, please try the new version. If dst_port isn't the field name in your index, then change it to the field name you have for the ports in your indexed data.</P> Tue, 14 Mar 2017 11:03:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-to-compare-the-value-of-a-field-with-a/m-p/352821#M104430 jkat54 2017-03-14T11:03:47Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-to-compare-the-value-of-a-field-with-a/m-p/352822#M104431 <P>thanks so much ! it worked</P> Tue, 14 Mar 2017 12:44:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-to-compare-the-value-of-a-field-with-a/m-p/352822#M104431 soesia12 2017-03-14T12:44:15Z