https://community.splunk.com/t5/Splunk-Search/Result-of-two-different-search/m-p/492435#M194338 <P>Hello , </P> <P>i have a csv file that contains the list of all existing services, and i have a search already created that gives the active services now, so i need a search that gives me the name of service not active (missing in search result of active services) ==&gt; so how to compare the csv file contents and the active service result to extract the non-active services ?</P> Thu, 03 Oct 2019 11:28:23 GMT aalaa 2019-10-03T11:28:23Z https://community.splunk.com/t5/Splunk-Search/Result-of-two-different-search/m-p/492435#M194338 <P>Hello , </P> <P>i have a csv file that contains the list of all existing services, and i have a search already created that gives the active services now, so i need a search that gives me the name of service not active (missing in search result of active services) ==&gt; so how to compare the csv file contents and the active service result to extract the non-active services ?</P> Thu, 03 Oct 2019 11:28:23 GMT https://community.splunk.com/t5/Splunk-Search/Result-of-two-different-search/m-p/492435#M194338 aalaa 2019-10-03T11:28:23Z https://community.splunk.com/t5/Splunk-Search/Result-of-two-different-search/m-p/492436#M194339 <P>Hi aalaa,<BR /> is it the same question of yesterday ( <A href="https://answers.splunk.com/answers/774566/compare-output-of-a-search-to-a-lookup-file.html#answer-774569">https://answers.splunk.com/answers/774566/compare-output-of-a-search-to-a-lookup-file.html#answer-774569</A> ) or a different one?<BR /> Because the answer is the same!</P> <PRE><CODE> index=my_index | eval service=lower(service) | stats count BY service | append [ | inputlookup Oracle_services.csv | eval count=0, service=lower(service) | fields count service ] | stats sum(count) AS Total BY service | where Total=0 </CODE></PRE> <P>Bye.<BR /> Giuseppe</P> Thu, 03 Oct 2019 11:38:19 GMT https://community.splunk.com/t5/Splunk-Search/Result-of-two-different-search/m-p/492436#M194339 gcusello 2019-10-03T11:38:19Z https://community.splunk.com/t5/Splunk-Search/Result-of-two-different-search/m-p/492437#M194340 <P>Hi ,</P> <P>it doesn't work for me , i need another proposition please </P> Thu, 03 Oct 2019 12:43:55 GMT https://community.splunk.com/t5/Splunk-Search/Result-of-two-different-search/m-p/492437#M194340 aalaa 2019-10-03T12:43:55Z