https://community.splunk.com/t5/Splunk-Search/How-to-find-the-delta-what-values-are-missing-in-lookup-table/m-p/653562#M225849 <P>Hi,<BR /><BR /></P><P>I am facing issues to find delta.</P><P>I have:</P><P><STRONG>Lookup Table</STRONG>: testpolicies.csv</P><P><STRONG>Field names in Lookup</STRONG>: policyname</P><P>index=test sourcetype =test_sourcetype policy=*</P><P><STRONG>Field names :</STRONG>&nbsp;&nbsp;policy</P><P>Now, need to compare Lookup table with&nbsp; sourcetype using policy field and find all the records/rows which are not exist in Lookup table but in sourcetype. This comparison is based on policy field</P><P>Any recommendations will be highly appreciated. Thank you so much.</P> Tue, 08 Aug 2023 11:22:06 GMT innoce 2023-08-08T11:22:06Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-delta-what-values-are-missing-in-lookup-table/m-p/653562#M225849 <P>Hi,<BR /><BR /></P><P>I am facing issues to find delta.</P><P>I have:</P><P><STRONG>Lookup Table</STRONG>: testpolicies.csv</P><P><STRONG>Field names in Lookup</STRONG>: policyname</P><P>index=test sourcetype =test_sourcetype policy=*</P><P><STRONG>Field names :</STRONG>&nbsp;&nbsp;policy</P><P>Now, need to compare Lookup table with&nbsp; sourcetype using policy field and find all the records/rows which are not exist in Lookup table but in sourcetype. This comparison is based on policy field</P><P>Any recommendations will be highly appreciated. Thank you so much.</P> Tue, 08 Aug 2023 11:22:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-delta-what-values-are-missing-in-lookup-table/m-p/653562#M225849 innoce 2023-08-08T11:22:06Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-delta-what-values-are-missing-in-lookup-table/m-p/653563#M225850 <LI-CODE lang="markup">index=test sourcetype=test_sourcetype NOT [| inputlookup testpolicies.csv | rename policyname as policy | table policy]</LI-CODE> Tue, 08 Aug 2023 11:30:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-delta-what-values-are-missing-in-lookup-table/m-p/653563#M225850 ITWhisperer 2023-08-08T11:30:48Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-delta-what-values-are-missing-in-lookup-table/m-p/653565#M225851 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp; Hi, This is the expected behaviour<BR /><BR />data:<BR />policy 1<BR />policy 11<BR />policy 111<BR />policy 2<BR />policy 22<BR />policy 222</P><P>testpolicies.csv<BR />policy 11<BR />policy 22<BR />policy 222</P><P>Expected result:<BR />policy 1<BR />policy 111<BR />policy 2</P> Tue, 08 Aug 2023 12:28:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-delta-what-values-are-missing-in-lookup-table/m-p/653565#M225851 innoce 2023-08-08T12:28:42Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-delta-what-values-are-missing-in-lookup-table/m-p/653567#M225852 <P>Your expected result is the opposite of what you said you are trying to do&nbsp;</P><BLOCKQUOTE><HR /><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/237678">@innoce</a>&nbsp;wrote:<BR /><P><SPAN>Now, need to compare Lookup table with&nbsp; sourcetype using policy field and find all the records/rows which are not exist in Lookup table but in sourcetype. This comparison is based on policy field</SPAN></P><HR /></BLOCKQUOTE><P>Please clarify which way round you want it</P> Tue, 08 Aug 2023 11:56:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-delta-what-values-are-missing-in-lookup-table/m-p/653567#M225852 ITWhisperer 2023-08-08T11:56:44Z