https://community.splunk.com/t5/Splunk-Search/How-to-compare-event-data-with-lookup-data-to-find-missing-field/m-p/659004#M227593 <P>To find out which fields are present in the lookup and absent in the index use a subsearch, like this:</P><LI-CODE lang="markup">| inputlookup test_data.csv where NOT [search index=test sourcetype=splunk_test_data | fields field1 field2 | format]</LI-CODE> Thu, 28 Sep 2023 19:38:04 GMT richgalloway 2023-09-28T19:38:04Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-event-data-with-lookup-data-to-find-missing-field/m-p/658983#M227585 <P>I need to compare the values of 2 fields from the Splunk data with the field-values from the lookup and find the missing values from the Splunk data and output those missing field value pairs</P><P>For ex:</P><P>index=test&nbsp; sourcetype=splunk_test_data<BR />fields: field1, field2<BR /><BR />lookup: test_data.csv<BR />Fields: field1, field2</P><P>The output should show missing values from the Splunk data and output those missing values<BR /><BR />Any help would be appreciated&nbsp;<BR />Thanks</P> Mon, 02 Oct 2023 10:19:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-event-data-with-lookup-data-to-find-missing-field/m-p/658983#M227585 gauravu_14 2023-10-02T10:19:44Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-event-data-with-lookup-data-to-find-missing-field/m-p/659004#M227593 <P>To find out which fields are present in the lookup and absent in the index use a subsearch, like this:</P><LI-CODE lang="markup">| inputlookup test_data.csv where NOT [search index=test sourcetype=splunk_test_data | fields field1 field2 | format]</LI-CODE> Thu, 28 Sep 2023 19:38:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-event-data-with-lookup-data-to-find-missing-field/m-p/659004#M227593 richgalloway 2023-09-28T19:38:04Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-event-data-with-lookup-data-to-find-missing-field/m-p/659281#M227653 <P>I would like to know which values are missing in the events compared to the lookup and output those field-values</P> Mon, 02 Oct 2023 10:18:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-event-data-with-lookup-data-to-find-missing-field/m-p/659281#M227653 gauravu_14 2023-10-02T10:18:23Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-event-data-with-lookup-data-to-find-missing-field/m-p/659284#M227654 <P>The same search should do that.&nbsp; It's a matter of how extensive the lookup file is.</P> Mon, 02 Oct 2023 12:09:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-event-data-with-lookup-data-to-find-missing-field/m-p/659284#M227654 richgalloway 2023-10-02T12:09:16Z