https://community.splunk.com/t5/Splunk-Search/How-to-convert-values-in-a-single-row-with-missing-fields/m-p/619428#M215286 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/250925">@AZURAKAGAMI</a>,</P><P>you can use the solution for missed hosts that you can find in many answers (also from me) in Community.</P><P>So, if you have the Username field both in your main search and in your lookup, you could try something like this:</P><LI-CODE lang="markup">&lt;your_search&gt; | eval Username=lower(Username) | stats count BY Username | append [ | inputlookup filename.csv | eval Username=lower(Username), count=0 | fields Username count ] | stats sum(count) AS total BY Username | where total=0</LI-CODE><P>Ciao.</P><P>Giuseppe</P> Thu, 03 Nov 2022 09:12:44 GMT gcusello 2022-11-03T09:12:44Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-values-in-a-single-row-with-missing-fields/m-p/619426#M215285 <P>Hi,</P> <P><SPAN>How to display what values are missing in my lookup table comparing to actual data?</SPAN></P> <P>&nbsp;</P> <P>I have one field with lists of users from my csv file.&nbsp; I took a specific range of users and trying to find out which of users are missing from my csv file. I cannot find a solution, can someone help me out?</P> <P>&nbsp;</P> <P><U><EM><STRONG>My query.</STRONG></EM></U></P> <P>|inputlookup filename.csv</P> <P>|search Username IN (user A,&nbsp; user B, User C, etc.)</P> <P>|dedup Username |fields Username</P> Thu, 03 Nov 2022 13:53:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-values-in-a-single-row-with-missing-fields/m-p/619426#M215285 AZURAKAGAMI 2022-11-03T13:53:02Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-values-in-a-single-row-with-missing-fields/m-p/619428#M215286 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/250925">@AZURAKAGAMI</a>,</P><P>you can use the solution for missed hosts that you can find in many answers (also from me) in Community.</P><P>So, if you have the Username field both in your main search and in your lookup, you could try something like this:</P><LI-CODE lang="markup">&lt;your_search&gt; | eval Username=lower(Username) | stats count BY Username | append [ | inputlookup filename.csv | eval Username=lower(Username), count=0 | fields Username count ] | stats sum(count) AS total BY Username | where total=0</LI-CODE><P>Ciao.</P><P>Giuseppe</P> Thu, 03 Nov 2022 09:12:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-values-in-a-single-row-with-missing-fields/m-p/619428#M215286 gcusello 2022-11-03T09:12:44Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-values-in-a-single-row-with-missing-fields/m-p/619432#M215287 <P>Hi, Giuseppe,</P><P>Thank you for your quick response but that didn't help. Your search is giving me list of all users that I have in my csv file (which is enormous amount) but I found a solution to this.</P><P>Thank you for your time anyways.</P><LI-CODE lang="markup">| makeresults | eval Username="User A, User B, User C, User D, User E, User F" | makemv delim="," Username | mvexpand Username | fields - _time | lookup filename.csv Username | search NOT fieldname=*</LI-CODE><P>&nbsp;</P> Thu, 03 Nov 2022 09:50:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-values-in-a-single-row-with-missing-fields/m-p/619432#M215287 AZURAKAGAMI 2022-11-03T09:50:08Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-values-in-a-single-row-with-missing-fields/m-p/619445#M215288 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/250925">@AZURAKAGAMI</a>,</P><P>sorry I didn't understand your need, probably this solution is easier:</P><P>&nbsp;</P><LI-CODE lang="markup">| makeresults | eval Username="User A, User B, User C, User D, User E, User F" | makemv delim="," Username | mvexpand Username | search NOT [ | inputlookup filename.csv | fields Username]</LI-CODE><P>&nbsp;</P><P>Ciao.</P><P>Giuseppe</P><P>P.S.: Karma Points are appreciated <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Thu, 03 Nov 2022 12:05:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-values-in-a-single-row-with-missing-fields/m-p/619445#M215288 gcusello 2022-11-03T12:05:14Z