https://community.splunk.com/t5/Splunk-Search/How-to-compare-search-result-with-a-lookup-file/m-p/383938#M112139 <P>Try like this</P> <PRE><CODE>index=sql sourcetype="mssql:execution:dm_exec_sessions" host="*" | rename client_net_address AS "IP_Origem" current_database_name AS Datase_Name original_login_name AS "Usuário" |stats count by login_time, IP_Origem, Datase_Name , Usuário | where NOT [| inputlookup YourLookupTable.csv | table original_login_name, client_net_address ,Datase_Name | rename original_login_name AS "Usuário" , client_net_address as AS "IP_Origem" ]|sort - count </CODE></PRE> Thu, 14 Jun 2018 19:06:45 GMT somesoni2 2018-06-14T19:06:45Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-search-result-with-a-lookup-file/m-p/383937#M112138 <P>I have a lookup file with the following fields</P> <BLOCKQUOTE> <P>original_login_name, client_net_address and Datase_Name<BR /> I have these my fields in my search for splunk, using the query</P> <P>index=sql sourcetype="mssql:execution:dm_exec_sessions" host="*" | rename client_net_address AS "IP_Origem" current_database_name AS Datase_Name original_login_name AS "Usuário" |stats count by login_time, IP_Origem, Datase_Name, Usuário |sort - count</P> </BLOCKQUOTE> <P>How do I make a comparison between the search and the lookup, so that it returns me to only results that are not the same as the original_login_name, client_net, address and Datase_name fields?</P> <P>Examples: </P> <P>Lookup:<BR /> Fields: original_login_name, client_net_address, Datase_name<BR /> Value: aud_cdt, 10.1.1.5, Teste</P> <P>Logs:<BR /> Fields: original_login_name, client_net_address, Datase_name<BR /> Value: aud_cdt, 10.1.1.5, Teste<BR /> Value: aud_cdt, 10.1.1.8, Teste<BR /> Value: edt_aud, 10.1.1.5, Teste</P> <P>The search should return the following results:<BR /> Value: aud_cdt, 10.1.1.8, Teste<BR /> Value: edt_aud, 10.1.1.5, Teste</P> Tue, 29 Sep 2020 20:00:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-search-result-with-a-lookup-file/m-p/383937#M112138 LeandroKopke 2020-09-29T20:00:21Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-search-result-with-a-lookup-file/m-p/383938#M112139 <P>Try like this</P> <PRE><CODE>index=sql sourcetype="mssql:execution:dm_exec_sessions" host="*" | rename client_net_address AS "IP_Origem" current_database_name AS Datase_Name original_login_name AS "Usuário" |stats count by login_time, IP_Origem, Datase_Name , Usuário | where NOT [| inputlookup YourLookupTable.csv | table original_login_name, client_net_address ,Datase_Name | rename original_login_name AS "Usuário" , client_net_address as AS "IP_Origem" ]|sort - count </CODE></PRE> Thu, 14 Jun 2018 19:06:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-search-result-with-a-lookup-file/m-p/383938#M112139 somesoni2 2018-06-14T19:06:45Z