topic Return values in CSV lookup not in index in Splunk Search https://community.splunk.com/t5/Splunk-Search/Return-values-in-CSV-lookup-not-in-index/m-p/493504#M137647 <P>My CSV has 98 rows and I want the search to return the rows from that csv if they are not in my index=gcp*</P> <P>what i have here is the opposite, it matches if its in index=gcp* -- i need to flip it basically.</P> <PRE><CODE>index=gcp* | rename data.jsonPayload.rule_details.reference as FW | search FW = "network:prod*" | rex field=FW "network:prod-a/firewall:(?&lt;fw&gt;.*)" | rex field=FW "network:prod-b/firewall:(?&lt;fw&gt;.*)" | rex field=FW "network:prod-c/firewall:(?&lt;fw&gt;.*)" | rex field=FW "network:prod-d/firewall:(?&lt;fw&gt;.*)" | rex field=FW "network:prod-e/firewall:(?&lt;fw&gt;.*)" | lookup firewall-exception-prod-num.csv firewall_rule as fw OUTPUT firewall_rule as fw | dedup fw | table fw </CODE></PRE> Mon, 11 May 2020 17:06:16 GMT katmagee 2020-05-11T17:06:16Z Return values in CSV lookup not in index https://community.splunk.com/t5/Splunk-Search/Return-values-in-CSV-lookup-not-in-index/m-p/493504#M137647 <P>My CSV has 98 rows and I want the search to return the rows from that csv if they are not in my index=gcp*</P> <P>what i have here is the opposite, it matches if its in index=gcp* -- i need to flip it basically.</P> <PRE><CODE>index=gcp* | rename data.jsonPayload.rule_details.reference as FW | search FW = "network:prod*" | rex field=FW "network:prod-a/firewall:(?&lt;fw&gt;.*)" | rex field=FW "network:prod-b/firewall:(?&lt;fw&gt;.*)" | rex field=FW "network:prod-c/firewall:(?&lt;fw&gt;.*)" | rex field=FW "network:prod-d/firewall:(?&lt;fw&gt;.*)" | rex field=FW "network:prod-e/firewall:(?&lt;fw&gt;.*)" | lookup firewall-exception-prod-num.csv firewall_rule as fw OUTPUT firewall_rule as fw | dedup fw | table fw </CODE></PRE> Mon, 11 May 2020 17:06:16 GMT https://community.splunk.com/t5/Splunk-Search/Return-values-in-CSV-lookup-not-in-index/m-p/493504#M137647 katmagee 2020-05-11T17:06:16Z Re: Return values in CSV lookup not in index https://community.splunk.com/t5/Splunk-Search/Return-values-in-CSV-lookup-not-in-index/m-p/493505#M137648 <P>use <CODE>|inputlookup your_csv</CODE></P> Mon, 11 May 2020 19:28:47 GMT https://community.splunk.com/t5/Splunk-Search/Return-values-in-CSV-lookup-not-in-index/m-p/493505#M137648 to4kawa 2020-05-11T19:28:47Z