https://community.splunk.com/t5/Splunk-Search/Difference-between-lookup-and-search-i-only-want-the-unique/m-p/597564#M208053 <P>Hi All,</P> <P>&nbsp;</P> <P>I have a splunk query which i cannot get to work for the life of me:&nbsp; This is the search<BR /><BR /></P> <LI-CODE lang="markup">|inputlookup feeds.csv | fields "Threat Feed" |table "Threat Feed" |eval observed=1 |append [search index=main sourcetype="feeds" source="/opt/splunkforwarder/bin/scripts/stats.sh" type=feed |rename dn as "Threat Feed" customerID as companyId |table "Threat Feed" companyId | join companyId [| dbxquery query="mysql query" ] |eval observed = 0] |stats min(observed) as observed values(customerId) as cs by "Threat Feed" | where observed =1</LI-CODE> <P><BR /><BR />Current Result:<BR /><BR />Threat Feed (column name)<BR />Feed55 &lt;&lt;&lt; Correct feed that should not exist in any of the customers<BR /><BR />The csv file only has a column named Threat Feed, there are five rows only.<BR /><BR />The search results are around 25 different feeds per customer (50 customers)<BR /><BR />I am interested in showing which feeds from the CSV do not exist in the search results i.e from the 25 feeds, i need this by customer so that i can create an alert.</P> <P>At the moment i am getting an output of the 1 feed name that doesnt exist, but i cant link this to the customer as the csv file does not have a customerID field as its a generic file.</P> Thu, 12 May 2022 14:14:56 GMT greekleo89 2022-05-12T14:14:56Z https://community.splunk.com/t5/Splunk-Search/Difference-between-lookup-and-search-i-only-want-the-unique/m-p/597564#M208053 <P>Hi All,</P> <P>&nbsp;</P> <P>I have a splunk query which i cannot get to work for the life of me:&nbsp; This is the search<BR /><BR /></P> <LI-CODE lang="markup">|inputlookup feeds.csv | fields "Threat Feed" |table "Threat Feed" |eval observed=1 |append [search index=main sourcetype="feeds" source="/opt/splunkforwarder/bin/scripts/stats.sh" type=feed |rename dn as "Threat Feed" customerID as companyId |table "Threat Feed" companyId | join companyId [| dbxquery query="mysql query" ] |eval observed = 0] |stats min(observed) as observed values(customerId) as cs by "Threat Feed" | where observed =1</LI-CODE> <P><BR /><BR />Current Result:<BR /><BR />Threat Feed (column name)<BR />Feed55 &lt;&lt;&lt; Correct feed that should not exist in any of the customers<BR /><BR />The csv file only has a column named Threat Feed, there are five rows only.<BR /><BR />The search results are around 25 different feeds per customer (50 customers)<BR /><BR />I am interested in showing which feeds from the CSV do not exist in the search results i.e from the 25 feeds, i need this by customer so that i can create an alert.</P> <P>At the moment i am getting an output of the 1 feed name that doesnt exist, but i cant link this to the customer as the csv file does not have a customerID field as its a generic file.</P> Thu, 12 May 2022 14:14:56 GMT https://community.splunk.com/t5/Splunk-Search/Difference-between-lookup-and-search-i-only-want-the-unique/m-p/597564#M208053 greekleo89 2022-05-12T14:14:56Z https://community.splunk.com/t5/Splunk-Search/Difference-between-lookup-and-search-i-only-want-the-unique/m-p/597908#M208202 <P>bump bump....</P> Mon, 16 May 2022 08:19:46 GMT https://community.splunk.com/t5/Splunk-Search/Difference-between-lookup-and-search-i-only-want-the-unique/m-p/597908#M208202 greekleo89 2022-05-16T08:19:46Z