https://community.splunk.com/t5/Splunk-Search/Search-lookup-for-non-matching-values/m-p/309337#M160233 <P>Try like this. The NOT subsearch will exclude all those foreign ip address from the main result itself.</P> <PRE><CODE>index=exchange_smtp Context=authenticated OR EHLO NOT [| inputlookup smtpforeignip.csv | table ipaddress ]| iplocation ipaddress | search Country != "United States" | transaction Session keepevicted=true | Search Context=authenticated | eval merged=user.Country | lookup user_location username as merged | search NOT target=* | table Data,Session,ipaddress,user,Country </CODE></PRE> Tue, 11 Jul 2017 15:51:08 GMT somesoni2 2017-07-11T15:51:08Z https://community.splunk.com/t5/Splunk-Search/Search-lookup-for-non-matching-values/m-p/309336#M160232 <P>I have the following search (MySearch), which is tied to an alert. </P> <PRE><CODE>index=exchange_smtp Context=authenticated OR EHLO | iplocation ipaddress | search Country != "United States" | transaction Session keepevicted=true | Search Context=authenticated | eval merged=user.Country | lookup user_location username as merged | search NOT target=* | table Data,Session,ipaddress,user,Country </CODE></PRE> <P>I have a lookup file called smtpforeignip.csv with a search that populates and updates this file with ipaddress,user,Country.</P> <P>I want to modify MySearch to do a comparison against smtpforeignip.csv. If there is a matching ipaddress I do not want the alert to trigger. I ONLY want the alert to trigger when there is a non-matching ipaddress.</P> Tue, 11 Jul 2017 15:07:11 GMT https://community.splunk.com/t5/Splunk-Search/Search-lookup-for-non-matching-values/m-p/309336#M160232 ldunzweiler 2017-07-11T15:07:11Z https://community.splunk.com/t5/Splunk-Search/Search-lookup-for-non-matching-values/m-p/309337#M160233 <P>Try like this. The NOT subsearch will exclude all those foreign ip address from the main result itself.</P> <PRE><CODE>index=exchange_smtp Context=authenticated OR EHLO NOT [| inputlookup smtpforeignip.csv | table ipaddress ]| iplocation ipaddress | search Country != "United States" | transaction Session keepevicted=true | Search Context=authenticated | eval merged=user.Country | lookup user_location username as merged | search NOT target=* | table Data,Session,ipaddress,user,Country </CODE></PRE> Tue, 11 Jul 2017 15:51:08 GMT https://community.splunk.com/t5/Splunk-Search/Search-lookup-for-non-matching-values/m-p/309337#M160233 somesoni2 2017-07-11T15:51:08Z