https://community.splunk.com/t5/Splunk-Search/How-to-create-a-lookup-subsearch-with-NOT-IN/m-p/589403#M205242 <P>I am facing following challenge. I have a lookup table myids.csv with ID's in it:</P> <P>ID<BR />1<BR />2<BR />3</P> <P>I have and index also with IDs in it (less than in the lookup):</P> <P>ID<BR />1<BR />2</P> <P>I am lookup for a way to only show the ID from the lookup that is not present in the index.</P> <P>ID<BR />3</P> <P>Any suggestions?</P> <P>&nbsp;</P> <P>&nbsp;</P> Wed, 16 Mar 2022 20:24:03 GMT ub_ik 2022-03-16T20:24:03Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-lookup-subsearch-with-NOT-IN/m-p/589403#M205242 <P>I am facing following challenge. I have a lookup table myids.csv with ID's in it:</P> <P>ID<BR />1<BR />2<BR />3</P> <P>I have and index also with IDs in it (less than in the lookup):</P> <P>ID<BR />1<BR />2</P> <P>I am lookup for a way to only show the ID from the lookup that is not present in the index.</P> <P>ID<BR />3</P> <P>Any suggestions?</P> <P>&nbsp;</P> <P>&nbsp;</P> Wed, 16 Mar 2022 20:24:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-lookup-subsearch-with-NOT-IN/m-p/589403#M205242 ub_ik 2022-03-16T20:24:03Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-lookup-subsearch-with-NOT-IN/m-p/589408#M205245 <P>The usual - append two sets, count, find the ones that have too few occurrences.</P><P><A href="https://www.duanewaddle.com/proving-a-negative/" target="_blank">https://www.duanewaddle.com/proving-a-negative/</A></P> Wed, 16 Mar 2022 20:44:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-lookup-subsearch-with-NOT-IN/m-p/589408#M205245 PickleRick 2022-03-16T20:44:51Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-lookup-subsearch-with-NOT-IN/m-p/589612#M205294 <P>perfect, thx a lot.</P> Fri, 18 Mar 2022 05:33:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-lookup-subsearch-with-NOT-IN/m-p/589612#M205294 ub_ik 2022-03-18T05:33:38Z