https://community.splunk.com/t5/Splunk-Search/How-to-compare-two-matching-field-from-two-look-up-table/m-p/654297#M226087 <P>I have two lookup table call lookup1.csv and lookup2.csv both has matching field call fullname.<BR />I want match my lookup1.csv to lookup2.csv and output the value not in the lookup1.csv byt in the lookup2.csv?</P> <P>| inputlookup lookup1.csv | search NOT [| inputlookup lookup.csv | field fullname]<BR /><BR />but this SPL displaying result found in the both look table. Is any way to do this in splunk?</P> <P>&nbsp;</P> <P>ADDVANCE Thanks</P> Mon, 14 Aug 2023 17:47:41 GMT abi2023 2023-08-14T17:47:41Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-two-matching-field-from-two-look-up-table/m-p/654297#M226087 <P>I have two lookup table call lookup1.csv and lookup2.csv both has matching field call fullname.<BR />I want match my lookup1.csv to lookup2.csv and output the value not in the lookup1.csv byt in the lookup2.csv?</P> <P>| inputlookup lookup1.csv | search NOT [| inputlookup lookup.csv | field fullname]<BR /><BR />but this SPL displaying result found in the both look table. Is any way to do this in splunk?</P> <P>&nbsp;</P> <P>ADDVANCE Thanks</P> Mon, 14 Aug 2023 17:47:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-two-matching-field-from-two-look-up-table/m-p/654297#M226087 abi2023 2023-08-14T17:47:41Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-two-matching-field-from-two-look-up-table/m-p/654299#M226089 <P>Your query is pretty close.&nbsp; Try the <FONT face="courier new,courier">where</FONT> option to <FONT face="courier new,courier">inputlookup</FONT> and use the <FONT face="courier new,courier">format</FONT> command to put the subsearch results in the right format.</P><LI-CODE lang="markup">| inputlookup lookup1.csv where NOT [| inputlookup lookup.csv | field fullname | format ]</LI-CODE><P>&nbsp;</P> Mon, 14 Aug 2023 17:57:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-two-matching-field-from-two-look-up-table/m-p/654299#M226089 richgalloway 2023-08-14T17:57:39Z